Syslog ingest
Receive RFC-style Syslog over UDP, TCP, or TLS and route messages to allowed data models.
Syslog ingest accepts logs from appliances, network devices, security tools, and systems that cannot send the normal JSON envelope.
Transport modes
| Mode | Production listener | Properties |
|---|---|---|
| UDP | Port 5514 | Connectionless; fastest but no delivery acknowledgement |
| TCP | Port 5515 | Reliable byte stream |
| TLS | Port 5516 | Encrypted stream; supports certificate-based controls |
Use the generated endpoint and instructions displayed by the client detail page. Infrastructure and tenant-specific endpoint values can change independently from these general listener defaults.
Message parsing
ReportPlane recognizes supported RFC Syslog shapes and extracts standard values such as hostname, app name, message, and transport context. Routing rules can then match extracted values, parse the message body, select a destination model, and map fields.
Client resolution
Each Syslog client receives a stable generated endpoint identity. When the deployment enables endpoint IPv6 routing, ReportPlane derives a deterministic address for that endpoint and resolves the client from the destination address.
Client resolution does not bypass policy. Expected-hostname and CIDR checks still apply when configured.
On a shared IPv4 listener, ReportPlane can fall back to globally unique expected-hostname or CIDR matching. Expected hostnames are normalized to lowercase without a trailing dot and cannot be claimed by two active clients.
Expected hostname
The expected hostname refers to the hostname inside the Syslog message when hostname identity is configured. It is not automatically the DNS name used by the sender to reach ReportPlane.
Generated endpoint stability
Editing a client preserves its existing generated endpoint host and internal endpoint ID. You do not need to reconfigure devices after ordinary policy or routing changes.
Choosing a mode
Prefer TLS when the device supports it. Use TCP when reliable delivery matters but TLS cannot be configured. Use UDP only when the source requires it and the workload tolerates datagram loss.