Creating Cribl Syslog Destination
You can configure Data Connector to use Syslog as a destination for transferring data from a source. First, do the following to ensure that forwarding of data to a Syslog destination is secure:
Click Configure > Administration > Data Connector.
On the Destination Configuration tab, from the Create drop-down list, choose Syslog.
Do the following in the Create Syslog Destination Configuration wizard:
Name: Provide a name that will distinguish this destination from others.
Description: Provide a description.
State: Use the slider to enable or disable the destination’s configuration, which will be disabled by default. If it is disabled, you will not be able to select this destination when you create a traffic flow.
Tags: Click Add and specify a meaningful name for the key and a value for the key, if required.
Format: Select CEF or LEEF based on your preferred log type.
In the SYSLOG DETAILS section, do the following:
FQDN/IP: Enter the Cribl Ingress IP or Address
Port: Enter the TCP/UDP port number that is listening for data in Cribl Source configuration.
Protocol: Select one of the supported protocols as per Cribl Source.
Click Save & Close.