The Log Pipeline

Introduces the rsyslog log pipeline — the flow of events from input to output through rulesets and queues. This overview shows how logs move through rsyslog’s architecture.

rsyslog processes logs through a log pipeline — internally called the message pipeline. Each log message moves through three conceptual stages:

Input: collects data from sources (sockets, files, journal).
Ruleset: filters, parses, or transforms the message.
Action: outputs the processed log to its destination.

flowchart LR subgraph "Input stage" I1["imkafka"]:::input I2["imjournal"]:::input I3["imfile"]:::input I4["..."]:::input I5["imtcp / imudp"]:::input end subgraph "Ruleset (logic)" F1["Filters<br>(if/then)"]:::ruleset P1["mmjsonparse"]:::ruleset T1["mmjsontransform"]:::ruleset end subgraph "Actions (outputs)" A1["omkafka"]:::action A2["omfwd / omrelp"]:::action A3["omhttp"]:::action A4["..."]:::action A5["omelasticsearch"]:::action end I1 --> F1 I2 --> F1 I3 --> F1 I4 --> F1 I5 --> F1 F1 --> A1 F1 --> A2 F1 --> A3 F1 --> A4 F1 --> A5 classDef input fill:#d5e8d4,stroke:#82b366; classDef ruleset fill:#dae8fc,stroke:#6c8ebf; classDef action fill:#ffe6cc,stroke:#d79b00;

Why this matters

Understanding the log pipeline helps you reason about reliability, performance, and transformations. Every input, rule, and action is a building block that you can compose into advanced pipelines with branching, staging, and queuing.

Subpages

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project