​

Deliver Events to a Syslog Receiver

​

When to use this scenario

​

1. Prepare the receiver

python3 - <<'PY'
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.bind(("0.0.0.0", 5514))
print("Listening UDP/5514; Ctrl+C to stop", flush=True)
while True:
    data, addr = s.recvfrom(65535)
    print("FROM", addr, "PAYLOAD", data.decode("utf-8", errors="replace"), flush=True)
PY

​

2. Configure the Syslog Destination

1. Open Destinations → Create (/destinations).
2. Set Name = Lab Syslog UDP, Type = SYSLOG_UDP.
3. Set Host to the actual receiver IP and Port = 5514. Save.
4. Confirm destination and protocol in the list. A saved Destination is not proof of UDP delivery.

​

3. Create the data flow

1. Use the Webhook Receiver Connector with a synthetic event such as {"id":"syslog-001","message":"hello syslog","severity":"low"}.
2. Open /streams/new and complete Connect → Sample & Record Selection with nonzero extracted records.
3. Choose Lab Syslog UDP under Destinations.
4. In Route Processing, keep a basic Transform, inspect the Route delivery settings and format preview if available.
5. Resolve blocking Deploy findings, save/deploy and enable/start the Stream as needed.

​

4. Send, observe and verify

curl --fail-with-body -X POST "$CONTROL_RECEIVER_URL" \
  -H 'Content-Type: application/json' \
  --data '{"id":"syslog-001","message":"hello syslog","severity":"low"}'

​

If it fails

• No datagram: check UDP firewall, container network, receiver listening address, Host/Port, Route enabled state.
• Logs show success but SIEM has no indexed event: debug SIEM parser/indexing separately; UDP success is not SIEM acceptance.
• Need TLS: use SYSLOG_TLS, valid trust chain and hostname verification; do not use this plaintext UDP example for protected production records.