> ## Documentation Index
> Fetch the complete documentation index at: https://control.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Deliver Events to a Syslog Receiver

> Create a SYSLOG_UDP Destination, route a test event, and verify the wire payload.

# Deliver Events to a Syslog Receiver

**Goal:** send one synthetic event to an independently monitored Syslog UDP listener. SYSLOG\_TCP and SYSLOG\_TLS are available as other Destination types, but this walkthrough deliberately exercises UDP only.

> [!NOTE]
>
> **Screen version:** The numbered images are historical Control UI test captures. Follow the current five-step flow (Connect → Sample & Record Selection → Destinations → Route Processing → Deploy), not older step ordering. See the [numbered screenshot guide](https://control.datarelay.run/use-cases/screen-walkthrough.md).

## When to use this scenario

This scenario builds on an existing Connector, Destination and Stream. If you have not configured a Source yet, start from the [connector-specific collection guides](https://control.datarelay.run/use-cases/index.md). Follow the concrete steps below and verify **actual Logs and Destination/quarantine evidence**. Existing test screenshots are illustrative, not runtime proof.

## 1. Prepare the receiver

Run this Python standard-library listener **on a test host reachable by the Control server**:

```bash theme={null}
python3 - <<'PY'
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.bind(("0.0.0.0", 5514))
print("Listening UDP/5514; Ctrl+C to stop", flush=True)
while True:
    data, addr = s.recvfrom(65535)
    print("FROM", addr, "PAYLOAD", data.decode("utf-8", errors="replace"), flush=True)
PY
```

Use a firewall to restrict UDP 5514 to the test sender; this listener has no authentication. If sending across Docker or hosts, **use the receiver host's reachable IP, not `127.0.0.1` by assumption**.

## 2. Configure the Syslog Destination

1. Open **Destinations → Create** (`/destinations`).
2. Set **Name** = `Lab Syslog UDP`, **Type** = `SYSLOG_UDP`.
3. Set **Host** to the actual receiver IP and **Port** = `5514`. Save.
4. Confirm destination and protocol in the list. A saved Destination is not proof of UDP delivery.

## 3. Create the data flow

1. Use the [Webhook Receiver Connector](https://control.datarelay.run/use-cases/webhook-first-flow.md) with a synthetic event such as `{"id":"syslog-001","message":"hello syslog","severity":"low"}`.
2. Open `/streams/new` and complete **Connect → Sample & Record Selection** with nonzero extracted records.
3. Choose `Lab Syslog UDP` under **Destinations**.
4. In **Route Processing**, keep a basic Transform, inspect the Route delivery settings and format preview if available.
5. Resolve blocking **Deploy** findings, save/deploy and enable/start the Stream as needed.

![field-mapping — numbered Control historical UI capture](https://mintcdn.com/datarelay-control/Tl9_UibGAprPlCr8/images/screenshots/annotated/field-mapping.webp?fit=max\&auto=format\&n=Tl9_UibGAprPlCr8\&q=85\&s=15ae79d8a5249262f236f997f253d286)

*Figure 1. **Mapping an event to output fields.** ① Inspect the source sample, ② configure Field Mapping, ③ compare Final Event Preview. A preview does not prove real delivery.*

## 4. Send, observe and verify

```bash theme={null}
curl --fail-with-body -X POST "$CONTROL_RECEIVER_URL" \
  -H 'Content-Type: application/json' \
  --data '{"id":"syslog-001","message":"hello syslog","severity":"low"}'
```

Confirm the receiving terminal prints a UDP datagram associated with the new event, then open **Logs** and match the Stream and Route result. Depending on Route formatting, field names may differ on the wire; compare the configured Syslog payload rather than requiring unchanged JSON.

**PASS:** an actual UDP datagram arrives at the independent listener and a corresponding Route result is recorded. UDP has **no application-level delivery acknowledgement**, so these observations do not prove the downstream SIEM indexed the event.

## If it fails

* No datagram: check UDP firewall, container network, receiver listening address, Host/Port, Route enabled state.
* Logs show success but SIEM has no indexed event: debug SIEM parser/indexing separately; UDP success is not SIEM acceptance.
* Need TLS: use `SYSLOG_TLS`, valid trust chain and hostname verification; do **not** use this plaintext UDP example for protected production records.

**Related:** [Per-Route processing](https://control.datarelay.run/use-cases/multi-destination.md), [Incident response](https://control.datarelay.run/use-cases/delivery-incident.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.