.. _containers-user-collector:
.. _container.image.rsyslog-collector:

rsyslog/rsyslog-collector
=========================

.. meta::
   :description: Reference for the rsyslog collector container image, including enabled inputs, file outputs, Kafka module availability, RELP, and optional TLS settings.
   :keywords: rsyslog, collector, Docker, Kafka, RELP, TLS, syslog

.. summary-start

The ``rsyslog/rsyslog-collector`` image is the reusable central-receiver role in the rsyslog container family. By default it listens on UDP and TCP syslog, can optionally enable RELP and TLS, ships the ``omkafka`` module, and writes received messages to local files unless you mount additional rules.

.. summary-end

.. index::
   pair: containers; rsyslog/rsyslog-collector
   pair: Docker images; rsyslog/rsyslog-collector

Overview
--------

The ``rsyslog-collector`` container image extends the standard
:doc:`standard` base with modules for **centralised log aggregation**.
It is preconfigured to receive logs via UDP, TCP, and optionally RELP or TLS.
It also includes extra output modules such as ``omkafka`` for custom routing.
The packaged configuration writes received messages to local files. Additional
rules can be mounted into ``/etc/rsyslog.d/`` when you want to forward to
other backends or reshape the pipeline.

This image is the recommended starting point for building a log
collector or relay service.

The packaged collector still runs as root by default. Its shipped
configuration binds privileged listener ports such as ``514`` and
``6514`` and writes files under ``/var/log``.

The inherited regex lookup-table noise filter is applied before the
packaged collector file outputs. See :doc:`minimal` for the
``/etc/rsyslog/noise-drop.lkp_tbl`` format and matching behavior.

.. note::

   - **UDP (514/udp)** and **TCP (514/tcp)** are enabled by default.  
   - **RELP (2514/tcp)** is available but **disabled by default**.  
   - **TLS syslog (6514/tcp)** is available but **disabled by default**.
   - External deployments usually map RELP to **20514/tcp** to avoid conflicts
     with the standard syslog port.

Environment Variables
---------------------

Runtime behaviour can be tuned with the following variables:

These environment variables control the packaged collector snippets only.
Included modules such as ``omkafka`` are available for custom rules, but the
image does not expose Kafka output settings through built-in environment
variables. To forward to Kafka, mount an additional rsyslog config snippet
that loads or uses ``omkafka``.

.. _containers-user-collector-enable_udp:
.. envvar:: ENABLE_UDP

   Enable UDP syslog reception. Default ``on``.

.. _containers-user-collector-enable_tcp:
.. envvar:: ENABLE_TCP

   Enable TCP syslog reception. Default ``on``.

.. _containers-user-collector-enable_relp:
.. envvar:: ENABLE_RELP

   Enable RELP syslog reception (internal port ``2514/tcp``). Default ``off``.

.. _containers-user-collector-enable_tls:
.. envvar:: ENABLE_TLS

   Enable TLS-encrypted syslog reception on ``6514/tcp``. Default ``off``.

.. _containers-user-collector-tls_ca_file:
.. envvar:: TLS_CA_FILE

   CA certificate path for TLS listener validation. Empty by default.

.. _containers-user-collector-tls_cert_file:
.. envvar:: TLS_CERT_FILE

   Server certificate path for the TLS listener. Empty by default.

.. _containers-user-collector-tls_key_file:
.. envvar:: TLS_KEY_FILE

   Server private key path for the TLS listener. Empty by default.

.. _containers-user-collector-tls_auth_mode:
.. envvar:: TLS_AUTH_MODE

   Netstream authentication mode for the TLS listener. Default ``anon``.

.. _containers-user-collector-write_all_file:
.. envvar:: WRITE_ALL_FILE

   Write all messages to ``/var/log/all.log``. Default ``on``.

.. _containers-user-collector-write_json_file:
.. envvar:: WRITE_JSON_FILE

   Write JSON formatted messages to ``/var/log/all-json.log``. Default ``on``.

Custom Kafka forwarding
-----------------------

The collector image includes the Kafka plugin package, so ``omkafka`` is
available for custom configurations. Kafka forwarding is not enabled by the
packaged collector rules and is not configured via built-in environment
variables.

To use Kafka, mount an additional file into ``/etc/rsyslog.d/`` with an
``action(type="omkafka" ...)`` rule that fits your deployment.

.. _containers-user-collector-rsyslog_hostname:
.. envvar:: RSYSLOG_HOSTNAME
   :noindex:

   Hostname used inside rsyslog. Defaults to the value of ``/etc/hostname`` when unset.

.. _containers-user-collector-permit_unclean_start:
.. envvar:: PERMIT_UNCLEAN_START
   :noindex:

   Skip configuration validation when set. By default ``rsyslogd -N1`` validates the configuration.

.. _containers-user-collector-rsyslog_role:
.. envvar:: RSYSLOG_ROLE
   :noindex:

   Role name consumed by the entrypoint. Defaults to ``collector``.

Port Mapping Reference
----------------------

+-----------+----------------+------------------+-----------------+
| Protocol  | Container Port | Example External | Controlled by   |
+===========+================+==================+=================+
| UDP Syslog | 514/udp       | 514/udp          | ``ENABLE_UDP``  |
+-----------+----------------+------------------+-----------------+
| TCP Syslog | 514/tcp       | 514/tcp          | ``ENABLE_TCP``  |
+-----------+----------------+------------------+-----------------+
| RELP       | 2514/tcp      | 20514/tcp        | ``ENABLE_RELP`` |
+-----------+----------------+------------------+-----------------+
| TLS Syslog | 6514/tcp      | 6514/tcp         | ``ENABLE_TLS``  |
+-----------+----------------+------------------+-----------------+

Example Deployment (docker-compose)
-----------------------------------

A minimal configuration using `docker compose`:

.. code-block:: yaml

   version: "3.9"

   services:
     rsyslog-collector:
       image: rsyslog/rsyslog-collector:latest
       environment:
         ENABLE_UDP: "on"
         ENABLE_TCP: "on"
         ENABLE_RELP: "on"
         ENABLE_TLS: "off"
       ports:
         - "514:514/udp"    # Syslog UDP
         - "514:514/tcp"    # Syslog TCP
         - "20514:2514/tcp" # RELP (external 20514 → internal 2514)
         - "6514:6514/tcp"  # TLS syslog (optional)
       volumes:
         - ./data:/var/log   # Optional: collect logs on host

Verifying the Container
-----------------------

To confirm that the collector is listening on the expected ports:

.. code-block:: bash

   docker compose exec rsyslog-collector ss -tuln

This should show listeners on ``514/udp`` and ``514/tcp`` by default, plus
``2514/tcp`` when RELP is enabled and ``6514/tcp`` when TLS is enabled.

Production Deployments
----------------------

For a complete production deployment with dashboards, alerting, and log storage,
see :doc:`../deployments/rosi_collector/index`. ROSI Collector builds on this
container image to provide Grafana visualization, Loki log storage, and
Prometheus metrics collection. In that deployment, Docker Compose mounts
additional rsyslog snippets so the collector forwards to Loki and exposes the
collector on external port ``10514`` for plain TCP clients.

.. seealso::

   - :doc:`../configuration/modules/omkafka` - Kafka action module reference
   - :doc:`../deployments/rosi_collector/index` - Complete log collection stack
   - `GitHub Discussions <https://github.com/rsyslog/rsyslog/discussions>`_ for community support.
   - `rsyslog Assistant AI <https://rsyslog.ai>`_ for self-help and examples.
