# How to setup Promtail (in Docker) to receive external syslog messages?

**URL:** <https://community.grafana.com/t/how-to-setup-promtail-in-docker-to-receive-external-syslog-messages/79795>\
**Category:** Grafana Loki\
**Created:** [January 16, 2023, 10:57pm UTC](https://community.grafana.com/t/how-to-setup-promtail-in-docker-to-receive-external-syslog-messages/79795 "2023-01-16T22:57:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jm2022](https://avatars.discourse-cdn.com/v4/letter/j/8491ac/32.png) [@jm2022](https://community.grafana.com/u/jm2022)\
**Post date:** [January 16, 2023, 10:57pm UTC](https://community.grafana.com/t/how-to-setup-promtail-in-docker-to-receive-external-syslog-messages/79795/1 "2023-01-16T22:57:30Z")

</div>

This is extremely confusing. So I’ve got Grafana/Loki up and running in a Docker container and I can see the hosts /var/logs, but I’m also trying to set it up to receive syslog streams from other devices on my network but in Grafana it’s not seeing the syslog job. I’m using Promtail 2.4.1 and Loki version 2.7.1 Here is the promtail config:

```auto
    server:
      http_listen_port: 9080
      grpc_listen_port: 0

    positions:
      filename: /tmp/positions.yaml

    clients:
      - url: http://loki:3100/loki/api/v1/push

    scrape_configs:
    - job_name: system
      static_configs:
      - targets:
          - localhost
        labels:
          job: varlogs
          __path__ : /var/log/*log
    - job_name: syslog
        syslog:
          listen_address: 0.0.0.0:1514
          idle_timeout: 60s
          label_structured_data: yes
          labels:
            job: "syslog"
        relabel_configs:
          - source_labels: ['__syslog_message_hostname']
            target_label: 'host'

```

Here is the docker compose file:

```auto
    version: "3"

    networks:
      loki:

    services:
      loki:
        image: grafana/loki:2.6.1
        ports:
          - "3100:3100"
        command: -config.file=/etc/loki/local-config.yaml
        networks:
          - loki

      promtail:
        image: grafana/promtail:2.6.1
        volumes:
          - /var/log:/var/logi
          - /home/user/Docker/promtail-config.yaml:/etc/promtail/config.yaml
        command: -config.file=/etc/promtail/config.yml
        networks:
          - loki

      grafana:
        image: grafana/grafana:latest
        ports:
          - "3000:3000"
        networks:
          - loki

```

So from what I understand, Promtail runs as a server that ingests logs and forwards them to Loki, and I read that I should just be able to simply point syslog configs to the Promtail service and it should forward them to Loki. So doesn’t this mean that there needs to be an exposed port in the docker container if Promtail is supposed to accept syslog pushes from other devices on the network? I haven’t found anywhere that mentions needing to setup ports for the Promtail container so I’m really confused on how this is supposed to work.

Edit: So I came across this [Scraping | Grafana Loki documentation](https://grafana.com/docs/loki/latest/clients/promtail/scraping/) and it says I should be able to use “listen\_protocol: udp” to specify the protocol (as the syslog message I’m trying to receive are UDP), but this results in the error

```auto
Unable to parse config: config-promtail.yml: yaml: unmarshal errors:
  line 20: field listen_protocol not found in type scrapeconfig.SyslogTargetConfig

```

Here is what the updated config file looks like:

```auto
positions:
  filename: /tmp/positions.yaml

clients:
  - url: "http://loki:3100/loki/api/v1/push"

scrape_configs:
  - job_name: "system"
    static_configs:
    - targets: ["localhost"]
      labels:
          job: "varlogs"
          __path__ : "/var/log/*log"
  - job_name: syslog
    syslog:
      listen_address: "0.0.0.0:514"
      listen_protocol: "udp"
      idle_timeout: 60s
      label_structured_data: yes
      labels:
        job: "syslog"
    relabel_configs:
      - source_labels: ['__syslog_message_hostname']
        target_label: 'host'
      - source_labels: [" __syslog_program__"]
        target_label: "program"
      - source_labels: [" __syslog_message__"]
        target_label: "message"

```

How is it that the documentation clearly states that “listen\_protocol” is an option, but I still get this error saying it’s unrecognized?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/grafana/original/2X/e/ef5308cc58c9e5a13187b5012eb99f406928462f.png) [@system](https://community.grafana.com/u/system)\
**Post date:** [January 16, 2024, 10:57pm UTC](https://community.grafana.com/t/how-to-setup-promtail-in-docker-to-receive-external-syslog-messages/79795/2 "2024-01-16T22:57:50Z")

</div>

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.