rsyslog/rsyslog-etl repository overview

⁠rsyslog/rsyslog-etl

rsyslog/rsyslog-etl is a specialized ingestion role that accepts syslog over the network and forwards events to a Vespa HTTP API.

⁠What it is for

Use this image when you want to:

• receive syslog over UDP, TCP, or RELP
• forward events to a Vespa document API with omhttp
• use rsyslog as a transport and delivery component in a Vespa-oriented ETL pipeline

⁠Default behavior

The image:

• listens on UDP syslog (514/udp) by default
• listens on TCP syslog (514/tcp) by default
• enables RELP on 2514/tcp by default
• forwards events to Vespa over HTTP
• is specialized for Vespa-oriented pipelines rather than generic all-destinations ETL use

⁠Useful environment variables

• ENABLE_UDP, ENABLE_TCP, ENABLE_RELP: control network listeners
• ENABLE_VESPA: enables the packaged Vespa HTTP action
• VESPA_NAMESPACE, VESPA_DOCTYPE: define the generated Vespa document path
• VESPA_SERVER, VESPA_PORT: define the Vespa HTTP endpoint
• RSYSLOG_HOSTNAME: sets the hostname used inside rsyslog
• PERMIT_UNCLEAN_START: skips startup config validation when set

⁠Notes

The packaged ETL output is HTTP to Vespa. The repository also includes a sample Docker Compose deployment for this image.

Documentation: https://www.rsyslog.com/doc/containers/etl.html⁠