tcplogreceiver

TCP Log Receiver

The TCP Log Receiver receives logs over TCP.

Status
Stability	alpha: logs
Distributions	contrib
Issues
Code coverage
Code Owners	@VihasMakwana | Seeking more code owners!
Emeritus	@djaglowski

Configuration

TLS Configuration

The tcp_log receiver supports TLS, disabled by default. config more detail opentelemetry-collector#configtls.

Operators

Each operator performs a simple responsibility, such as parsing a timestamp or JSON. Chain together operators to process logs into a desired format.

• Every operator has a type.
• Every operator can be given a unique id. If you use the same type of operator more than once in a pipeline, you must specify an id. Otherwise, the id defaults to the value of type.
• Operators will output to the next operator in the pipeline. The last operator in the pipeline will emit from the receiver. Optionally, the output parameter can be used to specify the id of another operator to which logs will be passed directly.
• Only parsers and general purpose operators should be used.

Parsers with Embedded Operations

Many parsers operators can be configured to embed certain followup operations such as timestamp and severity parsing. For more information, see complex parsers.

multiline configuration

If set, the multiline configuration block instructs the tcp_log receiver to split log entries on a pattern other than newlines.

The multiline configuration block must contain exactly one of line_start_pattern or line_end_pattern. These are regex patterns that match either the beginning of a new log entry, or the end of a log entry.

The omit_pattern setting can be used to omit the start/end pattern from each entry.

Supported encodings

Other less common encodings are supported on a best-effort basis. See https://www.iana.org/assignments/character-sets/character-sets.xhtml for other encodings available.

Example Configurations

Simple

Configuration:

receivers:
  tcp_log:
    listen_address: "0.0.0.0:54525"

The deprecated component type tcplog is still accepted:

receivers:
  tcplog:
    listen_address: "0.0.0.0:54525"

Advanced

Following configuration incorporates TLS, multiline config, operators and retry on failure:

receivers:
  tcp_log:
    listen_address: "0.0.0.0:54525"
    max_log_size: 2MiB
    one_log_per_packet: false
    add_attributes: true
    encoding: utf-8
    attributes:
      environment: "production"
      team: "backend"
    resource:
      service.name: "my-tcp-service"
      service.version: "1.0.0"
    tls:
      cert_file: "/etc/otel/certs/server.crt"
      key_file: "/etc/otel/certs/server.key"
      ca_file: "/etc/otel/certs/ca.crt"
      client_ca_file: "/etc/otel/certs/client-ca.crt"
    retry_on_failure:
      enabled: true
      initial_interval: 2s
      max_interval: 20s
      max_elapsed_time: 2m
    multiline:
      line_start_pattern: '^\d{4}-\d{2}-\d{2}' # logs starting with a date
      omit_pattern: true
    operators:
      - type: json_parser
        id: parse_json
        output: timestamp_parser