Syslog Receive Messages Trigger Node

Start a pipeline for each syslog message a switch, firewall, PLC, HMI or host sends that passes your filter, decoded into severity, facility, host, app, structured data and text.

Starts on

Each message that passes the filter

Function

Receive Messages

Transports

UDP · TCP · TLS

Dedup

On change, per hostname

Overview

Zoom

Syslog Receive Messages Trigger node

The Syslog Receive Messages Trigger Node starts a MaestroHub pipeline for every syslog message that a receive-mode Syslog connection gets and that passes the trigger function's filter. Equipment pushes syslog on its own, so this is fully event-driven: nothing is polled.

---

Core Functionality

What It Does

• Listens: the connection binds its UDP, TCP or TLS port when it starts; the trigger's function is a filter over that one stream of messages.
• Filters before the pipeline: minimum severity, facilities, and host and app name patterns are applied in the connector, so a debug flood from one device never becomes thousands of runs.
• Decodes: RFC 5424 and RFC 3164 are detected per message; header fields, structured data and the device time become result and _metadata keys.
• Keeps what does not parse: a message that is neither format is delivered with format: "unparsed" and the parse error, unless the function drops it.

Unauthenticated until TLS proves otherwise

Anyone who can reach a UDP or TCP syslog port can send a message, and a UDP source address can be spoofed. _metadata.authenticated is "true" only when the connection uses TLS with a CA Certificate and the sender's client certificate was verified; _metadata.tlsPeer then names it. Do not drive device writes or control commands from an unauthenticated trigger. See Receive mode is an open port.

---

Reconnection Handling

Automatic Recovery

The connection's health check probes its own listener: it sends a probe to the port and waits for the reader to see it. If the socket died, the probe fails and the runtime binds the port again. The trigger function's filter survives the rebind, so events flow again without editing anything.

What This Means for Your Workflows

• Messages sent while the listener is down are lost: syslog over UDP has no retransmission, and TCP senders reconnect on their own timer.
• A restart of MaestroHub binds the port again and resumes the saved pipeline.

---

Configuration Options

Basic Information

Field	Description
Name	The node name on the canvas
Description	Optional notes

Configuration

Field	Description
Connection	A Syslog connection in receive mode
Function	A Receive Messages (syslog.receive) function on it
Trigger Mode	always runs on every message; onChange skips a message whose result equals the last one from the same hostname

Receive Messages Function Configuration

Parameter	Default	Description
Minimum Severity	debug	Only messages at least this severe; a message without PRI passes this part
Facilities	all	Names or numbers, comma-separated
Host Name, App Name	all	Case-insensitive patterns with * and ?
Drop Unparsed Messages	off	Drop instead of delivering unparsed messages

---

Output Data Structure

Output Format

{
  "result": {
    "message": "Blocked 10.20.0.7 -> 10.4.2.31:502",
    "severity": 3,
    "severityName": "err",
    "facility": 23,
    "facilityName": "local7",
    "hostname": "fw-hall2",
    "appName": "filterlog",
    "procId": "4211",
    "msgId": "BLOCK",
    "structuredData": {"mh@32473": {"zone": "ot", "rule": "12"}},
    "format": "rfc5424"
  },
  "_metadata": {
    "protocol": "syslog",
    "transport": "tcp",
    "peerAddress": "10.4.9.2:51514",
    "format": "rfc5424",
    "hostname": "fw-hall2",
    "appName": "filterlog",
    "severity": "3",
    "facility": "23",
    "sourceTimestamp": "2026-11-03T08:14:07.412Z",
    "serverTimestamp": "2026-11-03T08:14:07.430918Z",
    "authenticated": "false"
  }
}

result Fields

Keys a message did not carry are absent, never filled with a placeholder.

Field	Description
message	The message text (MSG), without a byte-order mark; for an unparsed message, the text as received
format	rfc5424, rfc3164 or unparsed
severity	0 (emerg) to 7 (debug). Absent without a PRI
severityName	emerg, alert, crit, err, warning, notice, info or debug. Absent without a PRI
facility	0 to 23. Absent without a PRI
facilityName	kern … local7. Absent without a PRI
hostname	HOSTNAME; absent when the message had none or an RFC 5424 -
appName	APP-NAME, or the RFC 3164 tag; absent when the message had none
procId	PROCID, or the RFC 3164 tag's [pid]; absent when the message had none
msgId	MSGID (RFC 5424); absent when the message had none
structuredData	RFC 5424 structured data: SD-ID to parameter name to value
timestampCompleted	true when the year and zone of an RFC 3164 time were supplied by MaestroHub
messageRepaired	true when invalid UTF-8 was replaced with U+FFFD
raw	The message as received, base64, only when it was repaired
parseError	Why an unparsed message did not parse

_metadata Fields

Values are text, as all event metadata is.

Field	Description
_metadata.protocol	Always syslog
_metadata.transport	udp, tcp or tls
_metadata.peerAddress	The sender's address and port
_metadata.format	As result.format
_metadata.hostname	As result.hostname, when present
_metadata.appName	As result.appName, when present
_metadata.severity	The severity as a number in text, when present
_metadata.facility	The facility as a number in text, when present
_metadata.sourceTimestamp	The device's time in UTC, when the message carried one that parsed
_metadata.serverTimestamp	When MaestroHub received the message
_metadata.authenticated	"true" only after a verified client certificate (mutual TLS)
_metadata.tlsPeer	The verified client certificate's name, under mutual TLS

Referencing in Downstream Nodes

Expression	Value
$trigger.result.message	Blocked 10.20.0.7 -> 10.4.2.31:502
$trigger.result.severity	3
$trigger.result.structuredData["mh@32473"].zone	ot
$trigger._metadata.hostname	fw-hall2
$trigger._metadata.authenticated	false

For the connection, see the Syslog connection guide. To send syslog from a pipeline, see the Syslog nodes.