ListenSyslog

ListenSyslog 2.0.0

Bundle: org.apache.nifi | nifi-standard-nar
Description: Listens for Syslog messages being sent to a given port over TCP or UDP. Incoming messages are checked against regular expressions for RFC5424 and RFC3164 formatted messages. The format of each message is: (<PRIORITY>)(VERSION )(TIMESTAMP) (HOSTNAME) (BODY) where version is optional. The timestamp can be an RFC5424 timestamp with a format of "yyyy-MM-dd'T'HH:mm:ss.SZ" or "yyyy-MM-dd'T'HH:mm:ss.S+hh:mm", or it can be an RFC3164 timestamp with a format of "MMM d HH:mm:ss". If an incoming messages matches one of these patterns, the message will be parsed and the individual pieces will be placed in FlowFile attributes, with the original message in the content of the FlowFile. If an incoming message does not match one of these patterns it will not be parsed and the syslog.valid attribute will be set to false with the original message in the content of the FlowFile. Valid messages will be transferred on the success relationship, and invalid messages will be transferred on the invalid relationship.
Tags: listen, logs, syslog, tcp, udp
Input Requirement: FORBIDDEN
Supports Sensitive Dynamic Properties: false

Properties

Character Set
Specifies the character set of the Syslog messages. Note that Expression language is not evaluated per FlowFile.

Display Name

Character Set

Description

Specifies the character set of the Syslog messages. Note that Expression language is not evaluated per FlowFile.

API Name

Character Set

Default Value

UTF-8

Expression Language Scope

Environment variables defined at JVM level and system properties

Sensitive

false

Required

true
Client Auth
The client authentication policy to use for the SSL Context. Only used if an SSL Context Service is provided.
Display Name

Client Auth

Description

The client authentication policy to use for the SSL Context. Only used if an SSL Context Service is provided.

API Name

Client Auth

Default Value

REQUIRED

Allowable Values
- WANT
- REQUIRED
- NONE
Expression Language Scope

Not Supported

Sensitive

false

Required

false

Dependencies
- SSL Context Service is set to any value specified
Local Network Interface
The name of a local network interface to be used to restrict listening to a specific LAN.

Display Name

Local Network Interface

Description

The name of a local network interface to be used to restrict listening to a specific LAN.

API Name

Local Network Interface

Expression Language Scope

Environment variables defined at JVM level and system properties

Sensitive

false

Required

false
Max Batch Size
The maximum number of Syslog events to add to a single FlowFile. If multiple events are available, they will be concatenated along with the <Message Delimiter> up to this configured maximum number of messages

Display Name

Max Batch Size

Description

The maximum number of Syslog events to add to a single FlowFile. If multiple events are available, they will be concatenated along with the <Message Delimiter> up to this configured maximum number of messages

API Name

Max Batch Size

Default Value

1

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Max Number of TCP Connections
The maximum number of concurrent connections to accept Syslog messages in TCP mode.
Display Name

Max Number of TCP Connections

Description

The maximum number of concurrent connections to accept Syslog messages in TCP mode.

API Name

Max Number of TCP Connections

Default Value

2

Expression Language Scope

Not Supported

Sensitive

false

Required

true

Dependencies
- Protocol is set to any of [TCP]
Max Size of Message Queue
The maximum size of the internal queue used to buffer messages being transferred from the underlying channel to the processor. Setting this value higher allows more messages to be buffered in memory during surges of incoming messages, but increases the total memory used by the processor.

Display Name

Max Size of Message Queue

Description

The maximum size of the internal queue used to buffer messages being transferred from the underlying channel to the processor. Setting this value higher allows more messages to be buffered in memory during surges of incoming messages, but increases the total memory used by the processor.

API Name

Max Size of Message Queue

Default Value

10000

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Max Size of Socket Buffer
The maximum size of the socket buffer that should be used. This is a suggestion to the Operating System to indicate how big the socket buffer should be. If this value is set too low, the buffer may fill up before the data can be read, and incoming data will be dropped.
Display Name

Max Size of Socket Buffer

Description

The maximum size of the socket buffer that should be used. This is a suggestion to the Operating System to indicate how big the socket buffer should be. If this value is set too low, the buffer may fill up before the data can be read, and incoming data will be dropped.

API Name

Max Size of Socket Buffer

Default Value

1 MB

Expression Language Scope

Not Supported

Sensitive

false

Required

true

Dependencies
- Protocol is set to any of [TCP]
Message Delimiter
Specifies the delimiter to place between Syslog messages when multiple messages are bundled together (see <Max Batch Size> property).

Display Name

Message Delimiter

Description

Specifies the delimiter to place between Syslog messages when multiple messages are bundled together (see <Max Batch Size> property).

API Name

Message Delimiter

Default Value

\n

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Parse Messages
Indicates if the processor should parse the Syslog messages. If set to false, each outgoing FlowFile will only contain the sender, protocol, and port, and no additional attributes.
Display Name

Parse Messages

Description

Indicates if the processor should parse the Syslog messages. If set to false, each outgoing FlowFile will only contain the sender, protocol, and port, and no additional attributes.

API Name

Parse Messages

Default Value

true

Allowable Values
- true
- false
Expression Language Scope

Not Supported

Sensitive

false

Required

true
Port
The port for Syslog communication. Note that Expression language is not evaluated per FlowFile.

Display Name

Port

Description

The port for Syslog communication. Note that Expression language is not evaluated per FlowFile.

API Name

Port

Expression Language Scope

Environment variables defined at JVM level and system properties

Sensitive

false

Required

true
Protocol
The protocol for Syslog communication.
Display Name

Protocol

Description

The protocol for Syslog communication.

API Name

Protocol

Default Value

UDP

Allowable Values
- TCP
- UDP
Expression Language Scope

Not Supported

Sensitive

false

Required

true
Receive Buffer Size
The size of each buffer used to receive Syslog messages. Adjust this value appropriately based on the expected size of the incoming Syslog messages. When UDP is selected each buffer will hold one Syslog message. When TCP is selected messages are read from an incoming connection until the buffer is full, or the connection is closed.

Display Name

Receive Buffer Size

Description

The size of each buffer used to receive Syslog messages. Adjust this value appropriately based on the expected size of the incoming Syslog messages. When UDP is selected each buffer will hold one Syslog message. When TCP is selected messages are read from an incoming connection until the buffer is full, or the connection is closed.

API Name

Receive Buffer Size

Default Value

65507 B

Expression Language Scope

Not Supported

Sensitive

false

Required

true
Socket Keep Alive
Whether or not to have TCP socket keep alive turned on. Timing details depend on operating system properties.
Display Name

Socket Keep Alive

Description

Whether or not to have TCP socket keep alive turned on. Timing details depend on operating system properties.

API Name

socket-keep-alive

Default Value

false

Allowable Values
- true
- false
Expression Language Scope

Not Supported

Sensitive

false

Required

true

Dependencies
- Protocol is set to any of [TCP]
SSL Context Service
The Controller Service to use in order to obtain an SSL Context. If this property is set, syslog messages will be received over a secure connection.
Display Name

SSL Context Service

Description

The Controller Service to use in order to obtain an SSL Context. If this property is set, syslog messages will be received over a secure connection.

API Name

SSL Context Service

Service Interface

org.apache.nifi.ssl.RestrictedSSLContextService

Service Implementations

org.apache.nifi.ssl.StandardRestrictedSSLContextService

Expression Language Scope

Not Supported

Sensitive

false

Required

false

Dependencies
- Protocol is set to any of [TCP]

Relationships

Name	Description
invalid	Syslog messages that do not match one of the expected formats will be sent out this relationship as a FlowFile per message.
success	Syslog messages that match one of the expected formats will be sent out this relationship as a FlowFile per message.

Writes Attributes

Name	Description
syslog.priority	The priority of the Syslog message.
syslog.severity	The severity of the Syslog message derived from the priority.
syslog.facility	The facility of the Syslog message derived from the priority.
syslog.version	The optional version from the Syslog message.
syslog.timestamp	The timestamp of the Syslog message.
syslog.hostname	The hostname or IP address of the Syslog message.
syslog.sender	The hostname of the Syslog server that sent the message.
syslog.body	The body of the Syslog message, everything after the hostname.
syslog.valid	An indicator of whether this message matched the expected formats. If this value is false, the other attributes will be empty and only the original message will be available in the content.
syslog.protocol	The protocol over which the Syslog message was received.
syslog.port	The port over which the Syslog message was received.
mime.type	The mime.type of the FlowFile which will be text/plain for Syslog messages.