Inbound event source · v1.0.0
Syslog (through an edge adapter) (inbound event source)
Syslog lines that an edge adapter near the senders chose to forward (the syslog-adapter pack: Vector, filtering and classifying at the edge).
Use cases
- Each line arrives already classified: authentication failures, interface changes, configuration changes and critical severities become external.syslog.auth_failure, .link_change, .config_change and .critical; a line a customer added to the edge filter without a class becomes external.syslog.message.
- Full syslog belongs in a SIEM, not here.
- Give the adapter this event source's address and secret (Authorization: Bearer <secret>).
Syslog (through an edge adapter)inbound event source