github.com/honeycombio/honeytail@v1.9.0/parsers/syslog/README.md (about)

     1  # syslog parser
     2  
     3  Example CLI usage (from honeytail root)
     4  ```
     5  honeytail -p syslog -k $HONEYTAIL_WRITEKEY \
     6    -f /var/log/auth.log \
     7    --dataset 'MY_TEST_DATASET' \
     8    --syslog.mode 'rfc5424'
     9  ```
    10  
    11  ## Log Formatting
    12  
    13  You will need to configure your syslog daemon to use the right format. For example, to use RFC5424 with rsyslog, set the following in your /etc/rsyslog.conf.
    14  
    15  ```
    16  $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format
    17  ```
    18  
    19  __RFC5424__
    20  
    21  [RFC Text](https://www.ietf.org/rfc/rfc5424.txt)
    22  
    23  Example line
    24  
    25  ```
    26  <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"] An application event log entry...
    27  ```
    28  
    29  __RFC3164__
    30  
    31  [RFC Text](https://www.ietf.org/rfc/rfc3164.txt)
    32  
    33  Example line
    34  
    35  ```
    36  <34>Oct 11 22:14:15 mymachine su: 'su root' failed for user on /dev/pts/8
    37  ```