Send syslog

Rootprint has no syslog listener of its own, so you run Vector as a relay: it receives syslog on a socket, parses it into structured fields, and posts NDJSON to the NDJSON gateway.

rsyslog ──RFC5424/TCP──► Vector ──NDJSON──► Rootprint
        omfwd            syslog source

This guide creates a custom index whose fields match what Vector’s syslog source emits.

Prerequisites

A running Rootprint instance. Substitute its host for <your-rootprint>.
A Linux host running rsyslog (the default on Debian, Ubuntu, RHEL and derivatives). If you run journald only, see If you only run journald below.
A host to run Vector on. It can be the same machine that produces the logs, or a central relay that many machines forward to.

Setup

Create the syslog index

In Settings → Indexes → Create index, set the index ID to syslog, mode to dynamic, and the timestamp field to ts. Add these fields:

Field	Type	Tokenizer	Notes
`ts`	`datetime`	—	The timestamp field. Input formats `rfc3339` and `unix_timestamp`, millisecond precision.
`hostname`	`text`	`raw`
`appname`	`text`	`raw`
`procid`	`text`	`raw`	Text, not a number: RFC5424 permits `-` and non-numeric values.
`facility`	`text`	`raw`
`severity`	`text`	`raw`
`message`	`text`	`default`	Set record to `position` for phrase queries, and tick default search so a bare query matches the message body.

Under the optional settings, add appname, facility and severity as tag fields.dynamic mode keeps undeclared fields searchable: RFC5424 structured data (in a field named after its SD-ID) and the source_ip that Vector attaches to each record.

Map the display roles

On the new index’s Configuration tab, set the field-role mappings so the Logs page knows how to render a record:

Log level → severity
Message → message

The defaults assume the OpenTelemetry schema (severity_text, body.message), so records look blank until you change them.

Create an ingest API key

In Settings → API keys, click Create ingest key and pick the syslog index. Copy the rp_… key for the Vector config. See API keys.

Configure Vector

Install Vector from the official installation page, then save this at /etc/vector/vector.yaml. Replace <your-rootprint> and <your-ingest-api-key>.

Show vector.yaml

sources:
  syslog:
    type: syslog
    address: 0.0.0.0:5514
    mode: tcp

transforms:
  shape:
    type: remap
    inputs: [syslog]
    source: |
      .ts = .timestamp

      # Store PROCID as text; a missing value becomes "-".
      .procid = to_string(.procid) ?? "-"
      if .procid == "" { .procid = "-" }

      # Vector's own bookkeeping, not part of the index schema.
      del(.timestamp)
      del(.source_type)
      del(.host)
      del(.version)
      del(.msgid)

sinks:
  rootprint:
    type: http
    inputs: [shape]
    uri: https://<your-rootprint>/api/ingest/ndjson
    encoding:
      codec: json
    framing:
      method: newline_delimited # one object per line, not a JSON array
    auth:
      strategy: bearer
      token: <your-ingest-api-key>
    batch:
      max_bytes: 8388608
      timeout_secs: 1

Then restart it:

sudo systemctl restart vector
sudo systemctl status vector

Port 5514 rather than 514: Vector runs as the unprivileged vector user and cannot bind a port below 1024. If a sender has 514 hard-coded, grant CAP_NET_BIND_SERVICE with a systemd override instead of running Vector as root.

Point rsyslog at Vector

Save this as /etc/rsyslog.d/90-rootprint.conf, replacing <vector-host> with the machine running Vector (127.0.0.1 if it’s the same one):

*.* action(type="omfwd"
           target="<vector-host>"
           port="5514"
           protocol="tcp"
           template="RSYSLOG_SyslogProtocol23Format")

sudo systemctl restart rsyslog

RSYSLOG_SyslogProtocol23Format makes rsyslog send RFC5424 instead of RFC3164.*.* forwards everything. To send less, narrow the selector: auth,authpriv.* for authentication records, or local7.* if you route application logs to a local facility.

Verify in Rootprint

Send a test record:

logger -p local7.notice "hello from rsyslog"

Open Logs, pick syslog from the index selector, and query hello from rsyslog. Allow a few seconds for the record to become searchable.

If you only run journald

Modern distributions run systemd-journald, sometimes without rsyslog. Have journald forward its records to syslog. In /etc/systemd/journald.conf:

[Journal]
ForwardToSyslog=yes

sudo systemctl restart systemd-journald

Install rsyslog if it isn’t present. The configuration above applies unchanged.

Troubleshooting

Nothing arrives: check that rsyslog can reach Vector. ss -tnp | grep 5514 on the rsyslog host should show an established connection. On a central relay, suspect a firewall between the two.
403 from the NDJSON gateway: the ingest API key is wrong or revoked. If the config reads the key from ${VAR}, set VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION=true in Vector’s environment.
Records arrive but ts is wrong or missing: the sender uses RFC3164, which has no structured data and a lower-resolution timestamp. Confirm the template="RSYSLOG_SyslogProtocol23Format" line is present.
The program name appears in hostname, and the hostname in appname: an application (nginx, for example) writes its own syslog frames to /dev/log. Point it at 127.0.0.1:514 over UDP and load imudp in rsyslog instead.

Send logs over HTTP: the endpoint this guide posts to
Create a custom index: the full field-editor reference
Manage indexes: field-role mapping
Send logs with Vector: Vector install, systemd and Docker setup
Search query syntax: querying the fields above

Get Started

Send Logs

Traces

Search Logs

Manage Rootprint

Prerequisites

Setup

If you only run journald

Troubleshooting

​Prerequisites

​Setup

​If you only run journald

​Troubleshooting

​Related

Prerequisites

Setup

If you only run journald

Troubleshooting

Related