sinks:
   logscale_sink:
    type: logscale 
    url: "https://cloud.humio.com/" 
    token: "${LOGSCALE_TOKEN}"

Here, we defined a sink named logscale_sink that sends logs to a LogScale instance. The url specifies the destination, and the token is passed securely via an environment variable for authentication.

queue:
 type: disk
 maxLimitInMB: 10240

Here, we configured a disk-based queue to buffer syslog events with maximum limit of 10GB. This helps maintain data integrity during restarts or network interruptions.

sources:
 syslog-udp:
  type: syslog
  mode: udp  
  port: 514  
  sink: logscale_sink
  bind: "0.0.0.0"
  maxEventSize: 1048576
  workers: 4
  parser: "syslog_rfc5424"

Here, we defined a syslog_udp input source that listens for incoming UDP syslog traffic on port 514 and forward events to configured logscale_sink . Optional fields enable bind address, max event size, number of worker threads and parser.

transforms:
 - type: static_fields
  fields:
   source_type: "syslog_udp"
   environment: "${ENV}"

Here, we defined addition of static fields to syslog_udp source.

syslog_tcp:
 type: syslog
 mode: tcp  
 port: 1514 
 sink: logscale_sink
 bind: "0.0.0.0"
 maxEventSize: 1048576
 strict: true
 parser: "syslog_rfc5424"

Here, we added a syslog_tcp source for recieving syslog over TCP on port 1514. Optional fields enable binding, max event size, strict event validation and parser specification.

transforms:
 - type: static_fields
  fields:
   source_type: "syslog_tcp"
   environment: "${ENV}"

Here, we defined addition of static fields to syslog_tcp source.

Event Result set.