Syslog component

Q: How do I forward the parsed message as JSON?

Add a marshal step with json after the consumer, then send it on (for example to kafka).

Q: Does it understand old BSD syslog lines?

Yes. RFC 3164 lines are parsed too; format tells you which kind arrived.

The syslog component receives and sends syslog messages (RFC 5424 and RFC 3164) over UDP, TCP or TLS and parses them into structured fields.

Scheme: syslog: · Crate: cameleer-protocols · Cargo feature: protocols · Consumer: yes · Producer: yes · Apache Camel: Syslog data format

When to use it

Run a syslog gateway on an edge site: collect logs from routers, switches and devices and forward only the important ones upstream (Kafka, HTTP, a chat alert).
Turn syslog into structured JSON for a log pipeline or for an AI agent that triages alerts.
Send syslog messages from a route to an existing syslog server.

Difference from Apache Camel: Camel has a syslog data format that you combine with netty:udp://. Cameleer adds this syslog: component, and also provides the syslog data format.

URI format

text

syslog:udp://host:port[?options]
syslog:tcp://host:port[?options]
syslog:tls://host:port[?options]

The default port is 514 (6514 for tls). A consumer listens on host:port; a producer sends to it.

Example

yaml example: syslog-edge-gateway

- route:
    id: syslog-gateway
    from:
      uri: syslog:udp://0.0.0.0:{{env:SYSLOG_PORT:5514}}
      steps:
        - filter:
            simple: "${header.CamelSyslogSeverity} in 'EMERG,ALERT,CRIT,ERR'"
            steps:
              - setBody:
                  simple: "${header.CamelSyslogHostname}: ${body[logMessage]}"
              - to: log:alerts

<34>1 2026-11-05T10:00:00Z router1 sshd - - - authentication failure (severity CRIT) becomes router1: authentication failure; INFO messages are dropped.

Rust DSL

rust

use cameleer_core::prelude::*;

pub fn routes(ctx: &CamelContext) -> Result<()> {
    ctx.add_routes(|b| {
        b.from("syslog:udp://0.0.0.0:5514")
            .route_id("syslog-gateway")
            .filter(simple("${header.CamelSyslogSeverity} in 'EMERG,ALERT,CRIT,ERR'"))
            .set_body(simple("${header.CamelSyslogHostname}: ${body[logMessage]}"))
            .to("log:alerts")
            .end();
    })
}

Options

option	default	description
`unmarshal`	`true`	Consumer: the body is the parsed message (a map). `false` keeps the raw text.
`ssl`	`false`	Use TLS with `syslog:tcp://` (RFC 5425).
`sslContextParameters`		`#bean` with TLS settings; the consumer needs key material.
`useGlobalSslContextParameters`	`false`	Use the global `camel.ssl.*` parameters.
`charset`, `sync`, `textline`, `delimiter`, `receiveBufferSize`, `sendBufferSize`		Accepted and ignored.

The parsed body has the fields format (RFC5424 / RFC3164), priority, facility (name such as AUTH), facilityCode, severity (EMERG, ALERT, CRIT, ERR, WARNING, NOTICE, INFO, DEBUG), severityCode, version, timestamp, timestampMillis, hostname, appName, procId, msgId, structuredData and logMessage.

TCP accepts octet-counted (RFC 6587) and line-terminated frames. The producer sends one datagram (UDP) or one line (TCP), or an octet-counted frame over TLS. A map body is formatted as RFC 5424 first.

Message headers

header	direction	description
`CamelSyslogFacility`	out	Facility name.
`CamelSyslogSeverity`	out	Severity name.
`CamelSyslogHostname`	out	Host name from the message.
`CamelSyslogTimestamp`	out	Timestamp from the message.
`CamelSyslogRemoteAddress`, `CamelSyslogLocalAddress`	out	Socket addresses.

Run it with Docker

docker run --rm -p 5514:5514/udp -v "$PWD:/routes:ro" pmsudhi/cameleer run /routes/syslog.camel.yaml

Point devices at UDP port 5514 of the host. Use port 514 only if the container may bind privileged ports.

Common questions

How do I forward the parsed message as JSON?

Add a marshal step with json after the consumer, then send it on (for example to kafka).

Does it understand old BSD syslog lines?

Yes. RFC 3164 lines are parsed too; format tells you which kind arrived.

Found a problem?

If something on this page doesn't match what Cameleer does, or you hit a bug while building with it, please help fix it, whether you are a person or a coding agent: open an issue that describes what you saw, then fork the repository, fix it, add or update a test, run cargo test --workspace, and open a pull request. CONTRIBUTING.md explains the ground rules.