From 411f0b1668bb4191bddd86c74c4295fb6aaee3d8 Mon Sep 17 00:00:00 2001 From: LeonChapman <46498444+lchapman4@users.noreply.github.com> Date: Wed, 14 Jun 2023 16:00:34 -0400 Subject: [PATCH 1/9] Update use-tcp-endpoint-forward-logs-new-relic.mdx added optional instructions so customers can add custom attributes to their syslog data. --- ...se-tcp-endpoint-forward-logs-new-relic.mdx | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index da0e098cb90..e6ee164ee2f 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -74,12 +74,36 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos StreamDriverMode="1" ) ``` -6. Restart the `rsyslog` service by running: +6. Optional: Add custom attributes to your syslog data. Replace the `%structured-data%` section in the template string with custom tags/attributes. This can be accomplished in two ways: + a. Add custom attributes directly in the template string. Take note to escape the double quotes `"` for the string values. + + `[ ="" ="" ...]` + + ```properties + template(name="newrelic-rfc5424" + type="string" + string="YOUR_LICENSE_KEY <%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% [someId environment=\"prod\" region=\"US\"] %msg%\n" + ) + ``` + b. Add custom attributes using a custom property variable in the template string. Using this method allows users to avoid escaping string characters in the option above. + + ```properties + template(name="newrelic-rfc5424" + type="string" + string="YOUR_LICENSE_KEY <%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% %!custom-structured-data% %msg%\n" + ) + + set $!custom-structured-data = '[someId1 environment="prod" region="US"][someId2 team="sre" cost-center="123"]'; + ``` + + These methods above allow for extensive custom tagging of syslog data so that it can be consistent with the rest of the telemetry data. + +7. Restart the `rsyslog` service by running: ```bash sudo systemctl restart rsyslog ``` -7. [Check your New Relic account](/docs/logs/log-management/ui-data/explore-your-data-log-analytics) for logs. +8. [Check your New Relic account](/docs/logs/log-management/ui-data/explore-your-data-log-analytics) for logs. ## Configure rsyslog versions 8 and above with compression (Amazon Linux, Redhat, Centos) [#rsyslog-compression] From 8c7172052eac4171add0bd38b66181b92391d965 Mon Sep 17 00:00:00 2001 From: a-sassman Date: Wed, 14 Jun 2023 14:44:15 -0700 Subject: [PATCH 2/9] fix(docs): edits from peer review --- .../use-tcp-endpoint-forward-logs-new-relic.mdx | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index e6ee164ee2f..e384bade99a 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -74,8 +74,11 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos StreamDriverMode="1" ) ``` -6. Optional: Add custom attributes to your syslog data. Replace the `%structured-data%` section in the template string with custom tags/attributes. This can be accomplished in two ways: - a. Add custom attributes directly in the template string. Take note to escape the double quotes `"` for the string values. +6. (Optional): Add custom attributes to your `syslog` data + + To make your `syslog` data consistent with the rest of your telemetry data, you can add custom attributes. There are two ways to do this: + + a. **Add custom attributes directly in the template string.** You'll need to escape the double quotes (`"`) for the string values. For example: `[ ="" ="" ...]` @@ -85,7 +88,8 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos string="YOUR_LICENSE_KEY <%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% [someId environment=\"prod\" region=\"US\"] %msg%\n" ) ``` - b. Add custom attributes using a custom property variable in the template string. Using this method allows users to avoid escaping string characters in the option above. + + b. **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. ```properties template(name="newrelic-rfc5424" @@ -94,9 +98,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos ) set $!custom-structured-data = '[someId1 environment="prod" region="US"][someId2 team="sre" cost-center="123"]'; - ``` - - These methods above allow for extensive custom tagging of syslog data so that it can be consistent with the rest of the telemetry data. + ``` 7. Restart the `rsyslog` service by running: From b456b46aa4a589f30385543dbd208159b2921e52 Mon Sep 17 00:00:00 2001 From: ally sassman <42753584+ally-sassman@users.noreply.github.com> Date: Wed, 14 Jun 2023 14:45:02 -0700 Subject: [PATCH 3/9] Update src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx --- .../logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index e384bade99a..8fe02ac08bf 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -89,7 +89,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos ) ``` - b. **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. + b. **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string values. For example: ```properties template(name="newrelic-rfc5424" From 4c5cc232892851e0520c82cff8e43817856a6d0e Mon Sep 17 00:00:00 2001 From: ally sassman <42753584+ally-sassman@users.noreply.github.com> Date: Wed, 14 Jun 2023 14:46:25 -0700 Subject: [PATCH 4/9] Update src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx --- .../logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index 8fe02ac08bf..8a837007808 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -100,6 +100,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos set $!custom-structured-data = '[someId1 environment="prod" region="US"][someId2 team="sre" cost-center="123"]'; ``` +Make sure you replace the `%structured-data%` section in the template string with custom tags/attributes. 7. Restart the `rsyslog` service by running: ```bash From 758f86e3fd90880fd95c5433b43d22ab12d22c35 Mon Sep 17 00:00:00 2001 From: ally sassman <42753584+ally-sassman@users.noreply.github.com> Date: Wed, 14 Jun 2023 15:07:52 -0700 Subject: [PATCH 5/9] fix(docs): Update src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx --- .../use-tcp-endpoint-forward-logs-new-relic.mdx | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index 8a837007808..ebcb1bc808f 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -78,7 +78,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos To make your `syslog` data consistent with the rest of your telemetry data, you can add custom attributes. There are two ways to do this: - a. **Add custom attributes directly in the template string.** You'll need to escape the double quotes (`"`) for the string values. For example: + * **Add custom attributes directly in the template string.** You'll need to escape the double quotes (`"`) for the string values. For example: `[ ="" ="" ...]` @@ -87,21 +87,6 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos type="string" string="YOUR_LICENSE_KEY <%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% [someId environment=\"prod\" region=\"US\"] %msg%\n" ) - ``` - - b. **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string values. For example: - - ```properties - template(name="newrelic-rfc5424" - type="string" - string="YOUR_LICENSE_KEY <%pri%>%protocol-version% %timestamp:::date-rfc3339% %hostname% %app-name% %procid% %msgid% %!custom-structured-data% %msg%\n" - ) - - set $!custom-structured-data = '[someId1 environment="prod" region="US"][someId2 team="sre" cost-center="123"]'; - ``` - -Make sure you replace the `%structured-data%` section in the template string with custom tags/attributes. -7. Restart the `rsyslog` service by running: ```bash sudo systemctl restart rsyslog From 1d4d4e518d26525d8c5edd3a872dbf66da2265a9 Mon Sep 17 00:00:00 2001 From: a-sassman Date: Wed, 14 Jun 2023 15:11:32 -0700 Subject: [PATCH 6/9] Update use-tcp-endpoint-forward-logs-new-relic.mdx --- .../log-api/use-tcp-endpoint-forward-logs-new-relic.mdx | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index e384bade99a..d246833bdc2 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -78,7 +78,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos To make your `syslog` data consistent with the rest of your telemetry data, you can add custom attributes. There are two ways to do this: - a. **Add custom attributes directly in the template string.** You'll need to escape the double quotes (`"`) for the string values. For example: + * **Add custom attributes directly in the template string.** You'll need to escape the double quotes (`"`) for the string values. For example: `[ ="" ="" ...]` @@ -89,7 +89,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos ) ``` - b. **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. + * **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. ```properties template(name="newrelic-rfc5424" @@ -99,12 +99,15 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos set $!custom-structured-data = '[someId1 environment="prod" region="US"][someId2 team="sre" cost-center="123"]'; ``` + +Make sure you replace the `%structured-data%` section in the template string with custom tags/attributes. 7. Restart the `rsyslog` service by running: ```bash sudo systemctl restart rsyslog ``` + 8. [Check your New Relic account](/docs/logs/log-management/ui-data/explore-your-data-log-analytics) for logs. ## Configure rsyslog versions 8 and above with compression (Amazon Linux, Redhat, Centos) [#rsyslog-compression] From 3f231c72d797453ed21a294e3d5fd9c646652cb8 Mon Sep 17 00:00:00 2001 From: ally sassman <42753584+ally-sassman@users.noreply.github.com> Date: Wed, 14 Jun 2023 15:13:01 -0700 Subject: [PATCH 7/9] fix(docs): Update src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx --- .../logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index 6ec306c4bc6..c817502de2c 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -74,7 +74,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos StreamDriverMode="1" ) ``` -6. (Optional): Add custom attributes to your `syslog` data +6. (Optional): Add custom attributes to your `syslog` data. To make your `syslog` data consistent with the rest of your telemetry data, you can add custom attributes. There are two ways to do this: From 2e8ac6932c31d0917f6ee5fb28fc27669237d54d Mon Sep 17 00:00:00 2001 From: a-sassman Date: Wed, 14 Jun 2023 15:23:42 -0700 Subject: [PATCH 8/9] fix(docs): bullet point indentation --- .../logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index 6ec306c4bc6..ebdf88b1f98 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -89,7 +89,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos ) ``` - * **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. + * **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. ```properties template(name="newrelic-rfc5424" From cc4c58b69f34ae5ac55b27c68afa5dd0d8e6941a Mon Sep 17 00:00:00 2001 From: ally sassman <42753584+ally-sassman@users.noreply.github.com> Date: Wed, 14 Jun 2023 15:47:34 -0700 Subject: [PATCH 9/9] fix: change characters to values --- .../logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx index 746f94f0e1c..b1e5392e229 100644 --- a/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx +++ b/src/content/docs/logs/log-api/use-tcp-endpoint-forward-logs-new-relic.mdx @@ -89,7 +89,7 @@ To forward logs to New Relic with `rsyslog` for Amazon Linux, Redhat, and Centos ) ``` - * **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string characters. + * **Add custom attributes using a custom property variable in the template string.** This method avoids the need to escape string values. ```properties template(name="newrelic-rfc5424"