Syslog Nodes

Send a pipeline event to a syslog collector or SIEM, as an RFC 5424 or RFC 3164 message, over UDP, TCP or TLS.

Needs

A Syslog connection in send mode

Operations

Syslog Send Message

Formats

RFC 5424 · RFC 3164

Delivery

Accepted by the socket, never acknowledged

Send events from pipelines to the plant's syslog collector or SIEM. Each Send Message function authored on a send-mode Syslog connection is available as a node in the Pipeline Designer.

For connection setup, ports, TLS and the egress guard, see the Syslog connection guide.

For the event-driven trigger, see the Syslog Receive Messages Trigger. It starts a pipeline for each received message that passes a filter (trigger.syslog); its result is the decoded message, read as $trigger.result.message, $trigger.result.severity and so on.

Configuration Quick Reference

Field	What you choose	Details
Parameters	Connection, Function, Function Parameters, Timeout Override	Select the send-mode Syslog connection, pick a function, bind parameters with expression support, and optionally override the timeout.
Settings	Description, Timeout (seconds), Retry on Timeout, Retry on Fail, On Error	Node description, maximum execution time, retry behaviour and error strategy. All execution settings default to pipeline-level values.

---

Syslog Send Message Node

Zoom

Syslog Send Message node

Supported Function Types:

Node	Function	Purpose	Common Use Cases
Syslog Send Message (connected.syslog.send)	syslog.send	Format one message and send it to the collector	Forward machine alarms to the SIEM, log recipe changes centrally

Node Configuration

Parameter	Type	Required	Description
Message	string	Yes	The message text (MSG). Templatable.
Severity	integer 0 to 7	No	Default 6 (info). Templatable.
Facility	integer 0 to 23	No	Default 1 (user). Templatable.
Host Name, App Name, Process ID, Message ID	string	No	The RFC 5424 header fields; printable ASCII, no spaces.
Structured Data	JSON text	No	RFC 5424 only: {"line@32473": {"id": "3"}}.
Timestamp	RFC 3339	No	Empty uses the time of sending.

Every value is checked before anything is sent: a bad one fails the node with nothing written. A message longer than the connection's Max Message Bytes is refused, never cut.

Output Structure

{
  "result": {
    "accepted": true,
    "bytesWritten": 112,
    "format": "rfc5424",
    "framing": "octet-counting"
  }
}

Key	Meaning
result.accepted	The socket accepted the message's bytes. Syslog has no acknowledgement, so this is not proof the collector stored it
result.bytesWritten	How many bytes went to the socket, framing included
result.format	rfc5424 or rfc3164, as the connection's Message Format says
result.framing	octet-counting over TCP and TLS (RFC 6587, RFC 5425); none over UDP, one message per datagram

Delivery and Retries

• A write that failed after leaving may have reached the collector; it is Transient, and the platform may send it again, accepting a possible duplicate line.
• Store & Forward buffers Send Message through a collector outage: a log line repeated is a duplicate line, not a second machine action.
• Nothing is retried inside the connector; the node's Retry on Fail decides.