Syslog log drain

Overview

This topic explains how to send syslog-formatted logs (RFC 5424) to LaunchDarkly’s observability features using a syslog log drain. You can send logs directly from any system that supports syslog output, or configure a log stream from hosting platforms like Render.

Once configured, these logs appear in the Logs page of the LaunchDarkly user interface.

Prerequisites

Before you configure the syslog log drain, you must:

• Have LaunchDarkly observability enabled for your project
• Know your LaunchDarkly client-side ID

To find your client-side ID:

1. In the LaunchDarkly UI, click the project dropdown to open the project menu.
2. Select Project settings.
3. Click Environments.
4. Find the environment you want to use and copy the Client-side ID value.

Send syslog logs directly

You can send syslog logs formatted in RFC5424 over TLS to LaunchDarkly’s syslog endpoint.

Endpoint: syslog.observability.app.launchdarkly.com:34302

To test the connection, run the following command, replacing YOUR_CLIENT_SIDE_ID with your LaunchDarkly client-side ID:

$
echo "<0>1 2021-03-31T16:00:00-08:00 test-service YOUR_CLIENT_SIDE_ID 74440 YOUR_CLIENT_SIDE_ID - hello this is a test" | ncat --ssl syslog.observability.app.launchdarkly.com 34302

In this example, the structured data fields in the RFC5424 message are:

• APP-NAME (test-service): The name of your application or service.
• PROCID (YOUR_CLIENT_SIDE_ID): Set this to your LaunchDarkly client-side ID to associate logs with your project.
• MSGID (YOUR_CLIENT_SIDE_ID): Set this to your LaunchDarkly client-side ID.
• MSG (hello this is a test): The log message body.

Configure Render log streams

If you deploy your applications on Render, you can configure a log stream to automatically forward your logs to LaunchDarkly.

To configure the Render log stream:

1. In the Render dashboard, click your account dropdown in the top right corner and select Settings.
2. Click the Log Streams tab on the left.
3. Click Add Log Stream.
4. For the endpoint, enter syslog.observability.app.launchdarkly.com:34302.
5. For the token, enter your LaunchDarkly client-side ID.
6. Click Save.

To learn more about Render log streams, read Render’s log streams documentation.

Verify that logs are being received

After you configure the log drain, your syslog logs begin forwarding to LaunchDarkly.

To verify that your logs are being received:

1. Open the Telemetry section and navigate to the Logs list.
2. Choose or search for logs from your syslog-configured services.

It may take a few minutes for logs to appear after you first configure the log drain.

Filtering logs

You can configure ingestion filters to control which logs are stored in LaunchDarkly. This is useful for excluding noisy logs or limiting ingestion to stay within your observability quotas.

To learn more, read Filters.