Syslog Connection

General Information

Connection Type

syslog

UI Documentation

Endpoints

List Connections

GET /apiops/projects/{projectName}/connections/?type=syslog

Get Connection

GET /apiops/projects/{projectName}/connections/{connectionName}/

Create Connection

POST /apiops/projects/{projectName}/connections/{connectionName}/

Update Connection

PUT /apiops/projects/{projectName}/connections/{connectionName}/

Delete Connection

DELETE /apiops/projects/{projectName}/connections/{connectionName}/

---

List Connections

Endpoint

GET /apiops/projects/{projectName}/connections/?type=syslog

Request

Headers

Header	Value
Authorization	Bearer {token}

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name

Note: The type query parameter is required to filter connections by type.

cURL Example

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/connections/" \
  -H "Authorization: Bearer YOUR_TOKEN"

---

Get Connection

Endpoint

GET /apiops/projects/{projectName}/connections/{connectionName}/

Request

Headers

Header	Value
Authorization	Bearer {token}

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
connectionName	string	Yes	Connection name

Response

Success Response (200 OK)

{
  "success": true,
  "resultList": [
    {
      "type": "syslog",
      "name": "my-syslog-connection",
      "description": "Syslog connection for logging",
      "deployToWorker": true,
      "enabled": true,
      "syslogProtocolType": "TCP",
      "syslogMessageHostname": "apinizer.example.com",
      "syslogServerHostname": "syslog.example.com",
      "syslogPort": 514,
      "syslogTimeout": 500,
      "syslogMessageFormat": "RFC_3164",
      "syslogAppName": "Apinizer",
      "syslogFacility": "AUDIT",
      "syslogSeverity": "INFORMATIONAL",
      "syslogSslEnabled": true,
      "keyStoreName": "apinizer-gateway-client",
      "trustStoreName": "corp-ca-truststore",
      "syslogTlsHostnameVerification": true,
      "syslogStructuredDataEnabled": true,
      "syslogEnterpriseId": "99999"
    }
  ],
  "resultCount": 1
}

cURL Example

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/connections/my-syslog-connection/" \
  -H "Authorization: Bearer YOUR_TOKEN"

---

Create Connection

Endpoint

POST /apiops/projects/{projectName}/connections/{connectionName}/

Request

Headers

Header	Value
Authorization	Bearer {token}
Content-Type	application/json

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
connectionName	string	Yes	Connection name

Request Body

Full JSON Body Example - Basic UDP Connection

{
  "type": "syslog",
  "name": "my-syslog-connection",
  "description": "Syslog connection for logging",
  "deployToWorker": true,
  "enabled": true,
  "syslogProtocolType": "UDP",
  "syslogMessageHostname": "apinizer.example.com",
  "syslogServerHostname": "syslog.example.com",
  "syslogPort": 514,
  "syslogTimeout": 500,
  "syslogMessageFormat": "RFC_3164",
  "syslogAppName": "Apinizer",
  "syslogFacility": "AUDIT",
  "syslogSeverity": "INFORMATIONAL",
  "syslogSslEnabled": false
}

Full JSON Body Example - TCP with SSL

{
  "type": "syslog",
  "name": "my-syslog-tcp-ssl",
  "description": "Syslog TCP connection with SSL",
  "deployToWorker": true,
  "enabled": true,
  "syslogProtocolType": "TCP",
  "syslogMessageHostname": "apinizer.example.com",
  "syslogServerHostname": "syslog.example.com",
  "syslogPort": 514,
  "syslogTimeout": 5000,
  "syslogMessageFormat": "RFC_5424",
  "syslogAppName": "Apinizer",
  "syslogFacility": "LOCAL0",
  "syslogSeverity": "WARNING",
  "syslogSslEnabled": true
}

Full JSON Body Example - Mutual TLS with Structured Data

{
  "type": "syslog",
  "name": "my-syslog-mtls",
  "description": "Syslog TCP connection with mutual TLS and RFC 5424 structured data",
  "deployToWorker": true,
  "enabled": true,
  "syslogProtocolType": "TCP",
  "syslogMessageHostname": "apinizer.example.com",
  "syslogServerHostname": "syslog.example.com",
  "syslogPort": 6514,
  "syslogTimeout": 5000,
  "syslogMessageFormat": "RFC_5425",
  "syslogAppName": "Apinizer",
  "syslogFacility": "AUDIT",
  "syslogSeverity": "INFORMATIONAL",
  "syslogSslEnabled": true,
  "keyStoreName": "apinizer-gateway-client",
  "trustStoreName": "corp-ca-truststore",
  "syslogTlsHostnameVerification": true,
  "syslogStructuredDataEnabled": true,
  "syslogEnterpriseId": "99999"
}

Full JSON Body Example - RFC 5425 Format

{
  "type": "syslog",
  "name": "my-syslog-rfc5425",
  "description": "Syslog connection with RFC 5425 format",
  "deployToWorker": true,
  "enabled": true,
  "syslogProtocolType": "TCP",
  "syslogMessageHostname": "apinizer.example.com",
  "syslogServerHostname": "syslog.example.com",
  "syslogPort": 6514,
  "syslogTimeout": 10000,
  "syslogMessageFormat": "RFC_5425",
  "syslogAppName": "ApinizerGateway",
  "syslogFacility": "AUTH",
  "syslogSeverity": "ERROR",
  "syslogSslEnabled": true
}

Request Body Fields

Common Fields

Field	Type	Required	Default	Description
type	string	Yes	-	Connection type discriminator field. Identifies the connection type in API requests/responses.
name	string	Yes	-	Connection name (must match path parameter)
description	string	No	-	Connection description
deployToWorker	boolean	No	true	Whether to deploy to worker
enabled	boolean	No	true	Whether connection is enabled

Syslog-Specific Fields

Field	Type	Required	Default	Description
syslogProtocolType	string	No	TCP	Protocol type. See EnumSyslogProtocolType
syslogMessageHostname	string	No	-	Hostname to include in syslog messages (some cloud services use this for secret keys)
syslogServerHostname	string	Yes	-	Syslog server hostname or IP address
syslogPort	integer	No	514	Syslog server port (default: 514, standard Syslog port)
syslogTimeout	integer	No	500	Connection timeout in milliseconds (for TCP only)
syslogMessageFormat	string	No	RFC_3164	Message format. See MessageFormat
syslogAppName	string	No	Apinizer	Application name to include in syslog messages
syslogFacility	string	No	AUDIT	Syslog facility. See Facility
syslogSeverity	string	No	INFORMATIONAL	Syslog severity level. See Severity
syslogSslEnabled	boolean	No	false	Enable SSL/TLS encryption (TCP only)
keyStoreName	string	No	-	Name of the key store holding the client certificate presented for mutual TLS. Resolved to an identifier at write time; an unknown name is rejected. Empty means no client certificate is presented (server-only TLS).
trustStoreName	string	No	-	Name of the key store used to verify the syslog server's certificate chain. When set it becomes the only trust anchor for this connection; empty means the JVM default trust store is used.
syslogTlsHostnameVerification	boolean	No	false	Require the name in the server certificate (SAN or CN) to match syslogServerHostname. When false, only the certificate chain is verified.
syslogStructuredDataEnabled	boolean	No	false	Write the RFC 5424 STRUCTURED-DATA field. Effective only with RFC_5424 or RFC_5425 over TCP.
syslogEnterpriseId	string	No	-	IANA Private Enterprise Number used as the identifier of the Apinizer element inside structured data. Must match ^[0-9]{1,10}$. Empty means only the origin and timeQuality elements are written.
syslogMaxMessageBytes	integer	No	0	Maximum size, in UTF-8 bytes, of a single syslog message this connection sends, measured on the complete syslog message (header, structured data and body) and excluding only the RFC 6587 framing around it — the same quantity rsyslog measures with global(maxMessageSize=...). 0 disables splitting and keeps every record as one message. A positive value causes any record whose message would exceed it to be sent as several syslog messages instead, each carrying a [chunk i/N id] prefix in its message body. See Syslog for the receiver-side implications, including the RFC 5426 recommendation to stay under 2048 bytes on UDP.

Key store references: create and update requests carry keyStoreName and trustStoreName; reads return those names only. Raw storage IDs are rejected and never appear in the response or OpenAPI schema. A name that is missing, ambiguous, or outside the project/shared-administration scope is rejected with the same non-enumerating 400 Bad Request. An absent or null name preserves a still-valid stored reference, while "" clears the optional reference.

Enterprise number validation: a value that is not 1 to 10 digits — including a whitespace-only value — is rejected with 400 Bad Request and the message syslogEnterpriseId must be an IANA Private Enterprise Number (1 to 10 digits)!. null and an empty string are accepted and mean "not set".

EnumSyslogProtocolType (syslogProtocolType)

• TCP - TCP transport (reliable, ordered delivery, supports SSL)
• UDP - UDP transport (faster, but unreliable, no SSL support)

MessageFormat (syslogMessageFormat)

• RFC_3164 - BSD Syslog Protocol (RFC 3164)
• RFC_5424 - The Syslog Protocol (RFC 5424)
• RFC_5425 - Transport Layer Security (TLS) Transport Mapping for Syslog (RFC 5425)

Facility (syslogFacility)

• KERN - Kernel messages
• USER - User-level messages
• MAIL - Mail system
• DAEMON - System daemons
• AUTH - Security/authorization messages
• SYSLOG - Messages generated internally by syslogd
• LPR - Line printer subsystem
• NEWS - Network news subsystem
• UUCP - UUCP subsystem
• CRON - Clock daemon
• AUTHPRIV - Security/authorization messages (private)
• FTP - FTP daemon
• NTP - NTP subsystem
• AUDIT - Log audit
• ALERT - Log alert
• CLOCK - Clock daemon
• LOCAL0 - Local use 0
• LOCAL1 - Local use 1
• LOCAL2 - Local use 2
• LOCAL3 - Local use 3
• LOCAL4 - Local use 4
• LOCAL5 - Local use 5
• LOCAL6 - Local use 6
• LOCAL7 - Local use 7

Severity (syslogSeverity)

• EMERGENCY - System is unusable
• ALERT - Action must be taken immediately
• CRITICAL - Critical conditions
• ERROR - Error conditions
• WARNING - Warning conditions
• NOTICE - Normal but significant condition
• INFORMATIONAL - Informational messages
• DEBUG - Debug-level messages

Notes

• syslogServerHostname is required.
• syslogPort defaults to 514 (standard Syslog port).
• syslogProtocolType defaults to TCP.
• syslogSslEnabled is only applicable for TCP connections.
• keyStoreName, trustStoreName and syslogTlsHostnameVerification take effect only when syslogSslEnabled is true. They are stored as sent even when SSL is off, so turning SSL back on restores them.
• None of the TLS fields is required. A connection with syslogSslEnabled: true and no key store or trust store is a valid server-only TLS connection, and a connection with syslogSslEnabled: false keeps sending over plain TCP or UDP.
• syslogStructuredDataEnabled is ignored on UDP and with the RFC_3164 message format, because neither carries a structured-data field.
• syslogTimeout is only used for TCP connections.
• syslogMessageHostname can be used by some cloud Syslog services to transmit secret keys.
• syslogAppName defaults to "Apinizer".
• syslogMessageFormat defaults to RFC_3164 (BSD Syslog).
• RFC_5425 format typically uses port 6514 (TLS Syslog).
• syslogMaxMessageBytes of 0 (the default) is backward compatible: it keeps the pre-existing single-message behavior byte-for-byte, on every protocol and message format.

Response

Success Response (200 OK)

{
  "success": true,
  "deploymentResult": {
    "success": true,
    "deploymentResults": [
      {
        "environmentName": "production",
        "success": true,
        "message": "Deployment successful"
      }
    ]
  }
}

cURL Example

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/connections/my-syslog-connection/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "syslog",
    "name": "my-syslog-connection",
    "description": "Syslog connection for logging",
    "deployToWorker": true,
    "enabled": true,
    "syslogProtocolType": "UDP",
    "syslogServerHostname": "syslog.example.com",
    "syslogPort": 514,
    "syslogMessageFormat": "RFC_3164",
    "syslogAppName": "Apinizer",
    "syslogFacility": "AUDIT",
    "syslogSeverity": "INFORMATIONAL"
  }'

---

Update Connection

Endpoint

PUT /apiops/projects/{projectName}/connections/{connectionName}/

Request

Headers

Header	Value
Authorization	Bearer {token}
Content-Type	application/json

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
connectionName	string	Yes	Connection name (must match name in body)

Request Body

Full JSON Body Example

{
  "type": "syslog",
  "name": "my-syslog-connection",
  "description": "Updated Syslog connection for logging",
  "deployToWorker": true,
  "enabled": true,
  "syslogProtocolType": "TCP",
  "syslogMessageHostname": "apinizer-prod.example.com",
  "syslogServerHostname": "syslog-prod.example.com",
  "syslogPort": 6514,
  "syslogTimeout": 1000,
  "syslogMessageFormat": "RFC_5424",
  "syslogAppName": "Apinizer-Production",
  "syslogFacility": "LOCAL0",
  "syslogSeverity": "WARNING",
  "syslogSslEnabled": true
}

Note: Request body structure is the same as Create Connection. An absent or null keyStoreName/trustStoreName preserves a valid stored reference; "" clears it; a non-empty name replaces it. Other non-secret connection fields retain their existing full-update behavior.

Response

Success Response (200 OK)

{
  "success": true,
  "deploymentResult": {
    "success": true,
    "deploymentResults": [...]
  }
}

---

Delete Connection

Endpoint

DELETE /apiops/projects/{projectName}/connections/{connectionName}/

Request

Headers

Header	Value
Authorization	Bearer {token}

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
connectionName	string	Yes	Connection name

Response

Success Response (200 OK)

{
  "success": true,
  "deploymentResult": {
    "success": true,
    "deploymentResults": [...]
  }
}

---

Notes and Warnings

• Protocol Types:

  • TCP - Reliable, ordered delivery. Supports SSL/TLS encryption. Recommended for production.
  • UDP - Faster, but unreliable. No SSL support. Use for high-throughput scenarios where message loss is acceptable.

• Message Formats:

  • RFC_3164 - BSD Syslog Protocol (legacy, widely supported)
  • RFC_5424 - Modern Syslog Protocol (structured data support)
  • RFC_5425 - TLS Transport Mapping (RFC 5424 over TLS, typically uses port 6514)

• Ports:

  • Standard Syslog port: 514 (UDP/TCP)
  • TLS Syslog port: 6514 (TCP with SSL)

• SSL/TLS:

  • syslogSslEnabled: true enables SSL/TLS encryption (TCP only)
  • Use RFC_5425 format for TLS Syslog (port 6514)
  • UDP does not support SSL/TLS
  • keyStoreName adds a client certificate for mutual TLS; trustStoreName replaces the JVM default trust store for this connection
  • When a referenced key store cannot be read at run time, the connection stops sending instead of falling back to an unencrypted or unauthenticated session

• Structured Data:

  • syslogStructuredDataEnabled: true writes the RFC 5424 STRUCTURED-DATA field on RFC_5424 and RFC_5425 frames
  • Without syslogEnterpriseId, only the origin and timeQuality elements are written
  • A Private Enterprise Number can be requested from IANA

• Facility:

  • Facility codes identify the source of the message
  • Standard facilities: KERN, USER, MAIL, DAEMON, AUTH, etc.
  • Local facilities: LOCAL0 through LOCAL7 (custom use)
  • Default: AUDIT

• Severity:

  • Severity levels indicate message importance
  • Lower numeric values indicate higher severity
  • Default: INFORMATIONAL

• Timeout:

  • syslogTimeout is only used for TCP connections
  • Default: 500ms
  • Increase for slow networks or high-latency connections

• Message Hostname:

  • syslogMessageHostname is included in syslog messages
  • Some cloud Syslog services use this field to transmit secret keys
  • Can be different from syslogServerHostname

• Application Name:

  • syslogAppName identifies the application sending logs
  • Default: "Apinizer"
  • Useful for filtering logs by application

• Deployment: Connection changes require deployment to take effect. Set deployToWorker: true or deploy manually.

• Message Splitting (syslogMaxMessageBytes):

  • 0 (default) means no splitting — unchanged behavior.
  • A part's message body is prefixed with [chunk i/N id] ; on RFC_5424/RFC_5425 with syslogStructuredDataEnabled: true and a syslogEnterpriseId set, each part additionally carries an apinizerChunk@<PEN> structured-data element with the same index, total and identifier.
  • Reassembly is the receiver's responsibility — a split JSON payload is not valid JSON one part at a time.
  • This bounds message size, not queue admission: the parts of one split record are still admitted to the send queue together, as a single record, so syslogBufferMemoryBytes still applies to their combined size.

Related Documentation

• List Connections - List all connections
• Get Connection - Get a specific connection
• Create Connection - General connection creation guide
• Update Connection - General connection update guide
• Delete Connection - General connection deletion guide