> ## Documentation Index
> Fetch the complete documentation index at: https://docs-xcor.paloaltonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Syslog destination plugin

> Configure the Syslog destination plugin in Palo Alto Networks Telemetry Pipeline to send logs over Syslog.

export const entity_0 = "Syslog destination plugin"

export const plugin_0 = "Syslog destination plugin"

<Info>
  This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone
  product separate from Palo Alto Networks Cortex XCOR.
</Info>

The Syslog [destination plugin](/ingest/pipeline/plugins/destination-plugins)
(name: `syslog`) lets you configure your telemetry pipeline to transmit your
data to remote systems or services over the network.

## Supported telemetry types

The {plugin_0} for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

| Logs | Metrics | Traces |
| :-: | :-: | :-: |
| <Icon icon="circle-check" color="green" /> | <Icon icon="ban" color="red" /> | <Icon icon="ban" color="red" /> |

## Configuration parameters

Use the parameters in this section to configure the {entity_0}. The
Palo Alto Networks Telemetry Pipeline web interface uses the items in the **Name** column to
describe these parameters. [Pipeline configuration files](/ingest/pipeline/v2/configure/config-files)
use the items in the **Key** column as YAML keys.

### General

| Name | Key | Description | Default |
| - | - | - | - |
| **Host** | `host` | Required. Domain or IP address of the remote Syslog server. | `127.0.0.1` |
| **Port** | `port` | Required. TCP or UDP port of the remote Syslog server. | `514` |
| **Mode** | `mode` | Required. Selected transport type. Accepted values: `tcp`, `tls`, `udp`. | `udp` |
| **Syslog RFC Format** | `syslog_format` | Required. The Syslog protocol format to use. Accepted values: `rfc3164`, `rfc5424`. | `rfc5424` |
| **Syslog Message Key** | `syslog_message_key` | Required. This is the key name from the original record that contains the message to deliver. Required, otherwise the message is empty. | *none* |

### Advanced

| Name | Key | Description | Default |
| - | - | - | - |
| **Syslog Severity Key** | `syslog_severity_key` | Optional: The key name from the original record that contains the Syslog severity number. | *none* |
| **Syslog Severity Preset** | `syslog_severity_preset` | Optional: The preset severity number. It will be overwritten if `syslog_severity_key` is set and a key of a record is matched. | *none* |
| **Syslog Facility Key** | `syslog_facility_key` | Optional: The key name from the original record that contains the Syslog facility number. | *none* |
| **Syslog Facility Preset** | `syslog_facility_preset` | Optional: The preset facility number. It will be overwritten if `syslog_facility_key` is set and a key of a record is matched. | *none* |
| **Syslog Hostname Key** | `syslog_hostname_key` | Optional: The key name from the original record that contains the hostname that generated the message. | *none* |
| **Syslog Hostname Preset** | `syslog_hostname_preset` | Optional: The preset hostname. It will be overwritten if `syslog_hostname_key` is set and a key of a record is matched. | *none* |
| **Syslog Appname Key** | `syslog_appname_key` | Optional: The key name from the original record that contains the app name that generated the message. | *none* |
| **Syslog Appname Preset** | `syslog_appname_preset` | Optional: The preset app name. It will be overwritten if `syslog_appnam_key` is set and a key of a record is matched. | *none* |
| **Syslog ProcID Key** | `syslog_procid_key` | Optional: The key name from the original record that contains the Process ID that generated the message. | *none* |
| **Syslog ProcID Preset** | `syslog_procid_preset` | Optional: The preset ProcID. It will be overwritten if `syslog_procid_key` is set and a key of a record is matched. | *none* |
| **Syslog Message ID Key** | `syslog_msgid_key` | Optional: The key name from the original record that contains the Message ID associated to the message. | *none* |
| **Syslog Message ID Preset** | `syslog_msgid_preset` | Optional: The preset message ID. It will be overwritten if `syslog_msgid_key` is set and a key of a record is matched. | *none* |
| **Syslog Structured Data (SD) Key** | `syslog_sd_key` | Optional: The key name from the original record that contains the Structured Data (SD) content. | *none* |
| **Syslog Maxsize** | `syslog_maxsize` | The maximum size allowed per message, as an integer in bytes. | Default size based on the `syslog_format` value: `rfc3164` sets this to `1024`, and `rfc5424` sets this to `2048`. |

### Security and TLS

| Name | Key | Description | Default |
| - | - | - | - |
| **TLS** | `tls` | If `true`, enables TLS/SSL. If `false`, disables TLS/SSL. Accepted values: `true`, `false`. | `false` |
| **TLS Certificate Validation** | `tls.verify` | If `on`, and if `tls` is `true`, enables TLS/SSL certificate validation. If `off`, disables TLS/SSL certificate validation. Accepted values: `on`, `off`. | `on` |
| **TLS Debug Level** | `tls.debug` | Sets TLS debug verbosity level. Accepted values: `0` (No debug), `1` (Error), `2` (State change), `3` (Informational), `4` (Verbose). | `1` |
| **CA Certificate File Path** | `tls.ca_file` | Absolute path to CA certificate file. | *none* |
| **Certificate File Path** | `tls.crt_file` | Absolute path to certificate file. | *none* |
| **Private Key File Path** | `tls.key_file` | Absolute path to private key file. | *none* |
| **Private Key Path Password** | `tls.key_passwd` | Password for private key file. | *none* |
| **TLS SNI Hostname Extension** | `tls.vhost` | Hostname to be used for TLS SNI extension. | *none* |

### Advanced Networking

| Name | Key | Description | Default |
| - | - | - | - |
| **DNS Mode** | `net.dns.mode` | Selects the primary DNS connection type, which can be `TCP` or `UDP`. | *none* |
| **DNS Resolver** | `net.dns.resolver` | Selects the primary DNS connection type, which can be `LEGACY` or `ASYNC`. | *none* |
| **Prefer IPv4** | `net.dns.prefer_ipv4` | Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: `true`, `false`. | `false` |
| **Keepalive** | `net.keepalive` | Enables or disables Keepalive support. Accepted values: `true`, `false`. | `true` |
| **Keepalive Idle Timeout** | `net.keepalive_idle_timeout` | Sets the maximum time allowed for an idle Keepalive connection. | `30s` |
| **Max Connect Timeout** | `net.connect_timeout` | Sets the maximum time allowed to establish a connection, which includes the TLS handshake. | `10s` |
| **Max Connect Timeout Log Error** | `net.connect_timeout_log_error` | Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: `true`, `false`. | `true` |
| **Source Address** | `net.source_address` | Specifies the network address to bind for data traffic. | *none* |
| **Max Keepalive Recycle** | `net.keepalive_max_recycle` | Sets the maximum number of times a keepalive connection can be used before it's retired. | `2000` |


## Related topics

- [Devo Cloud destination plugin](/ingest/pipeline/plugins/destination-plugins/devo.md)
- [Syslog source plugin](/ingest/pipeline/plugins/source-plugins/syslog.md)
- [Graylog destination plugin](/ingest/pipeline/plugins/destination-plugins/graylog.md)
- [Send telemetry data with destination plugins](/ingest/pipeline/plugins/destination-plugins.md)
- [Axiom destination plugin](/ingest/pipeline/plugins/destination-plugins/axiom.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.