Does seq syslog require me to add a syslog container when seq is deployed in container instance

[rodneytamblyn]

I am attempting to enable Seq Syslog logging following https://docs.datalust.co/docs/syslog
My instance of Seq is deployed in docker as a multi-container instance: #2148 (comment)

Will I need to redeploy my Seq instance adding a seq-input-syslog container, or is it sufficient just to install the Seq syslog app in the Seq instance?

services:
  seq-input-syslog:
    image: datalust/seq-input-syslog:latest
    depends_on:
      - seq
    ports:
      - "514:514/udp"
    environment:
      SEQ_ADDRESS: "http://seq:5341"
    restart: unless-stopped

[rodneytamblyn]

... so it appears in container instance scenario I should not install the seq syslog app in my seq instance but I should instead re-deploy the container instance adding the seq-input-syslog sidecar.

I will give this a go.

[nblumhardt]

The app can be installed directly in the Docker scenario, but the syslog port will then need to be mapped/exposed by the container (-p 514:514 or equivalent). HTH!

[rodneytamblyn]

How does this work with ingestion? From what I can see the logs arrive at the seq-input-syslog container on UDP and are forwarded to the seq container. I'm asked to supply the FQDN for the server

SEQ_ADDRESS=https://seq.example.com:5341

• should I supply the secure external address e.g. https://myseqserver.xyz.com, or
• should I supply the container local address e.g. http://localhost:5000. (I have seq configured with an SSL sidecar so on localhost only it is available for comms between containers on http port 5000)
• do I need to allow unauthenticated http ingestion, or can I supply an API key?

[rodneytamblyn]

Yes, I need to supply API key variable:

SEQ_API_KEY