Description:

Provides a mechanism for reading RFC 5424 compliant Syslog data, such as log files, and structuring the data so that it can be processed.

Tags:

syslog 5424, syslog, logs, logfiles, parse, text, record, reader

Properties:

In the list below, the names of required properties appear in bold. Any other properties (not in bold) are considered optional. The table also indicates any default values, and whether a property supports the Expression Language Guide.

Name	Default Value	Allowable Values	Description
Character Set	UTF-8		Specifies which character set of the Syslog messages

State management:

This component does not store state.

Restricted:

This component is not restricted.

System Resource Considerations:

None specified.

Summary:

It provides a means for parsing valid [RFC 5424 Syslog](https://tools.ietf.org/html/rfc5424# “”) messages. This service produces records with a set schema to match the specification.
The Required Property of this service is named Character Set and specifies the Character Set of the incoming text.

Schemas

When a record is parsed from incoming data, it is parsed into the RFC 5424 schema.

The RFC 5424 schema

{ "type" : "record", "name" : "nifiRecord", "namespace" : "org.apache.nifi", "fields" : [ { "name" : "priority", "type" : [ "null", "string" ] }, { "name" : "severity", "type" : [ "null", "string" ] }, { "name" : "facility", "type" : [ "null", "string" ] }, { "name" : "version", "type" : [ "null", "string" ] }, { "name" : "timestamp", "type" : [ "null", { "type" : "long", "logicalType" : "timestamp-millis" } ] }, { "name" : "hostname", "type" : [ "null", "string" ] }, { "name" : "body", "type" : [ "null", "string" ] }, "name" : "appName", "type" : [ "null", "string" ] }, { "name" : "procid", "type" : [ "null", "string" ] }, { "name" : "messageid", "type" : [ "null", "string" ] }, { "name" : "structuredData", "type" : [ "null", { "type" : "map", "values" : { "type" : "map", "values" : "string" } } ] } ] }