dewgenenny/syslog-to-loki repository overview

⁠Syslog to Loki (via Grafana Alloy)

A simple Docker image that accepts Syslog messages (TCP/UDP port 514) and forwards them to a Grafana Loki instance. Built using Grafana Alloy⁠.

⁠Features

• Protocols: Supports both TCP and UDP syslog.
• Labeling: Automatically extracts and labels:
  • source_ip: IP address of the sender.
  • hostname: Hostname of the sender (if resolvable).
  • facility: Syslog facility.
  • severity: Syslog severity.
  • app_name: Program name from the syslog message.
  • protocol: tcp or udp.

⁠Usage

⁠Prerequisites

• A running Grafana Loki instance.

⁠Run with Docker

docker run -d \
  --name syslog-to-loki \
  -p 514:514/udp \
  -p 514:514/tcp \
  -e LOKI_URL="http://loki:3100/loki/api/v1/push" \
  --restart=always \
  dewgenenny/syslog-to-loki

⁠Environment Variables

⁠Troubleshooting

If Alloy fails to start with an error similar to:

Error: /etc/alloy/config.alloy:<line>:<column>: unrecognized attribute name "format"

make sure your loki.source.syslog listener blocks use syslog_format = "rfc3164" (or another valid value). The older format = "rfc3164" key is not recognized by newer Alloy releases.

⁠Building Locally

docker build -t dewgenenny/syslog-to-loki .

⁠Testing

You can test it using the logger command (if available) or netcat.

Using logger:

logger -n localhost -P 514 --udp -t myapp "Hello Loki"

Using netcat (RFC 3164):

echo "<13>Oct  1 12:00:00 localhost myapp: Simple test message" | nc -u -w 1 localhost 514