Syslog via LoadBalancer

[jfmatth]

HI, love the operator, makes deployment silly easy.

Trying to figure out how to let syslog UDP traffic into the LoadBalancer service for my splunk instance?

Thought i would just change the service definition, but adding what seems to be the right setup give an error?

Any help is appreciated

[akondur]

Hey @jfmatth , could you elaborate a little more on the setup you are requiring. Is this a request to help with ingress i.e data from Splunk Forwarders or otherwise to the indexers via a load balancer?

[jfmatth]

HI @akondur, thanks for the response.

At the time, I wanted to push my syslog traffic into K8s, but since then just built a stand alone Loki system, and eventually might push syslog into K8s, but for now, no need to work on this.

Ultimately I just wanted an inbound TCP service to accept syslog traffic and then send over to the splunk instance, if that helps.

[devinslick]

@jfmatth , and anyone else checking out this thread. If you create a UDP input for syslog you can then create a load balancer service to route that traffic to the Splunk pod. The issue I've found is that some syslog clients don't include their information, so you'll just see the load balancer's address as the source host. The only solution to this I'm aware of is to put another syslog server (syslog-ng/sc4s) in between the clients and the load balancer.