Receive syslog (RFC 5424 and RFC 3164)

receivers:
  syslog/rfc5424:
    tcp:
      listen_address: 0.0.0.0:54526
    protocol: rfc5424
  syslog/rfc3164:
    udp:
      listen_address: 0.0.0.0:54527
    protocol: rfc3164
    location: UTC

processors:
  memory_limiter:
    check_interval: 1s
    limit_percentage: 80
  batch: {}

exporters:
  otlphttp:
    endpoint: https://your-backend:4318

service:
  pipelines:
    logs:
      receivers: [syslog/rfc5424, syslog/rfc3164]
      processors: [memory_limiter, batch]
      exporters: [otlphttp]

// stability: public-preview — start Alloy with --stability.level=public-preview,
// or it exits at startup instead of running without the component.

otelcol.receiver.syslog "rfc5424" {
	protocol = "rfc5424"

	tcp {
		listen_address = "0.0.0.0:54526"
	}

	output {
		logs = [otelcol.processor.memory_limiter.default.input]
	}
}

otelcol.receiver.syslog "rfc3164" {
	protocol = "rfc3164"
	location = "UTC"

	udp {
		listen_address = "0.0.0.0:54527"
	}

	output {
		logs = [otelcol.processor.memory_limiter.default.input]
	}
}

otelcol.processor.memory_limiter "default" {
	check_interval   = "1s"
	limit_percentage = 80

	output {
		logs = [otelcol.processor.batch.default.input]
	}
}

otelcol.processor.batch "default" {
	output {
		logs = [otelcol.exporter.otlphttp.default.input]
	}
}

otelcol.exporter.otlphttp "default" {
	client {
		endpoint = "https://your-backend:4318"
	}
}