Docs

Torch Log Service

LogCollector collection

Collect Syslog logs

This topic describes the steps for creating a Syslog log collection configuration through the TLS console.

Notice

This feature is in closed beta. If you have relevant business needs, you can contact your account manager to enable the allowlist.

How it works

Syslog is a standardized log transmission protocol primarily used for collecting, forwarding, and storing system logs. It supports transport protocols such as UDP and TCP, but traditional implementations provide relatively basic functionality. For example, it often runs as the default logging service on Linux systems. ‌

TLS supports collecting Syslog logs through the console or uploading Syslog logs using the Syslog protocol. With TLS features such as query and analysis, processing, consumption, delivery, monitoring and alerting, and visualization, you can implement scenarios such as business operations monitoring and data statistical analysis.

Limits

Applicable only to Linux systems.

Only supported on hosts running LogCollector version 2.4.2 or later.

Prerequisites

A log project and log topic are created. For details, see Log project and Log topic.

A host group is created and the server heartbeat status is in normal state. For details, see Create host group (IP address) or Create host group (Host identification).

The host where LogCollector is installed must be able to access remote servers on port 80 and port 443.

The latest version of LogCollector has been installed on the host where the original logs reside. For details, see Install and upgrade LogCollector.

Steps

Step 1 Select a log space

Select the region where torch log service is located from the top navigation bar.

On the left navigation bar, select Common functions > Log Collection.

Then on the Log Collection page, in the LogCollector tab, click Create collection configuration.

Notice

For the regions below, manually select the log collection mode in the LogCollector tab.

Region: Hong Kong (China), Asia Pacific Southeast (Johor), Asia Pacific Southeast (Jakarta).

Select project and topic, and then click Next: Select host group.

The collected log data will be stored in the selected log topic.

Step 2 Select host group

In the All host groups section, select the specified host group for log collection.

If no host group is available in the list, you need to create a host group first. For specific instructions, see Create host group (IP address) or Create host group (Host identification).

After confirming the host group in the Selected host group section, click Next Step: Collection rule.

Step 3 Configure collection rule

Select Collection type, and then select Syslog collection.

Enter the Rule name.

Length must be between 3 and 64 characters.

Only Chinese characters, letters, numbers, underscores (_), and hyphens (-) are allowed.

Can not start or end with a hyphen (-).

Enter the Plugin configuration, and then click Next step: check index configuration.

Plugin configuration example:

{
"input": "syslog",
"detail": [
{
"address": "tcp://0.0.0.0:9998",
"parse_protocol": "auto",
"ignore_parse_failure": true
},
{
"address": "udp://0.0.0.0:9999",
"parse_protocol": "auto",
"ignore_parse_failure": true
}
]
}

Description of parameters:

Parameters	Type	Required	Description
input	string	Yes	Type of data source for collection, fixed as syslog.
address	string	NOT	Specify the protocol, address, and port that LogCollector listens to for log collection. The format is [tcp/udp]://[ip]:[port]. If not configured, the default is tcp:// 127.0.0.1:9999, which means only logs forwarded locally are received. Notice The forwarding rules must be consistent with those configured in the rsyslog configuration file. If the server where LogCollector is installed has multiple IP addresses that can receive logs, you can set it to 0.0.0.0 to listen on all IP addresses of the server.
parse_protocol	string	NOT	Specify the protocol used to parse logs. Empty: No parsing. rfc3164: Parse logs using the RFC3164 protocol. rfc5424: Parse logs using the RFC5424 protocol. auto: Automatically select the appropriate parsing protocol based on log content.
ignore_parse_failure	boolean	NOT	Specify the action to take when parsing fails. true (default): If not configured or set to true, parsing is skipped and the returned __content__ field is filled directly. false: Discard logs when parsing fails.

Step 4 Check index configuration

Check index configuration.

Follow the prompts on the page to set or update the index as needed. You can also click Import existing index configuration to import indexes from other log topics.

If this log topic does not have an index configured, refer to Configuration Index for setup.

If the index for this log topic is already configured, you can decide whether to update the index based on the log fields parsed by the collection rule.

Notice

You must enable the index to query and analyze the collected log data.

The updated index settings only apply to new data written afterward. For more instructions and limitations on query and analysis, see Query overview and Analysis Overview.

Click Submit.

Next steps

After you create the collection configuration, LogCollector collects logs and saves them to the specified log topic. You can then query and analyze logs in log topic. For details, see Query and analysis workflow.

Last updated: 2026.09.11 15:44:14