but .. unfortunately I really can't get it working. Either the logs are on the remote Rsyslog are broken .. or fluent-bit fails with

[ warn] [input:syslog:syslog.1] error parsing log message with parser 'syslog-rfc5424'

The local Rsyslog has:

action(type="omfwd" Target="127.0.0.1" Port="5140" Protocol="udp")

Fluent-bit Yaml has:

- name: syslog
      port: 5140
      parser: syslog-rfc5424
      tag: syslog
      mode: udp
      listen: 127.0.0.1
      buffer_chunk_size: 32000
      buffer_max_size: 64000
      receive_buffer_size: 512000
...

    - name: syslog
      match: "*"
      host: 192.168.42.182
      port: 514
      tls: off
      tls.verify: off
      mode: udp
      syslog_format: rfc5424
      syslog_maxsize: 2048
      syslog_hostname_key: hostname
      syslog_appname_key:  appname
      syslog_procid_key:   procid
      syslog_message_key:  log

And the remote Rsyslog has nothing special.

On the Remote rsyslog .. pretty strange .. I did not found the folder .. Usually, Rsyslog will create a folder with the hostname, which sends the logs .. but instead, the folder

-/2025/11/16/user.log

was created ...

On the nxlog (which I want to replace) there is nothing special, just:

<Output syslog-server>
    Module om_udp
    Host 192.168.42.182
    Port 514
    Exec $message =~ s/cardNo>\d\d\d\d\d\d\d\d\d\d\d\d/cardNo>XXXXXXXXXXXX/g;
	Exec $message =~ s/cvv>\d\d\d/cvv>XXX/g;
	Exec $message =~ s/cvv=\d\d\d/cvv=XXX/g;
	Exec $message =~ s/Verification%3E\d\d\d/Verification%3EXXX/g;
	Exec $message =~ s/R19%3E\d\d\d/R19%3EXXX/g;
	Exec $message =~ s/R16%3E\d\d\d\d\d\d\d\d\d\d\d\d/R16%3EXXXXXXXXXXXX/g;
	Exec $message =~ s/ccn=\d\d\d\d\d\d\d\d\d\d\d\d/ccn=XXXXXXXXXXXX/g;
	Exec $message =~ s/card_account=\d\d\d\d\d\d\d\d\d\d\d\d/card_account=XXXXXXXXXXXX/g;
	Exec $message =~ s/cvc_code=\d\d\d/cvc_code=XXX/g;
	Exec $message =~ s/password=/Password=XXX\&/g;
    Exec to_syslog_bsd();
</Output>

Any idea, what can be the issue?

maybe the issue is here, on the local rsyslog

# Enable RELP remote logging
template(name="forwardFormat" type="string"
         string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%$!msg:::sp-if-no-1st-sp%%$!msg%"
        )
module(load="omrelp")

If I use: rfc3164 then, the logs are on the remote rsyslog in the right folder .. but just date / time and hostname. The log entry itself is missing

hmm, a raw message looks like:

<86>Oct 16 13:00:25 fra-test-nomad-01 snoopy[1754224]: [login:dfuchs ssh:((undefined)) sid:1751529 tty:/dev/pts/3 (1024/dfuchs) uid:root(0)/root(0) cwd:/root]: logger -p info foo

via TCPdump. Maybe I need to create a custom parser.

Ok, I'm much closer now

I needed to tweak the parser and values on output

but prio and sev are not correct

I see, that :

syslog_severity_key:  severity
      syslog_facility_key:  facility

are not set ..

which means .. on the remote syslog, all goes to user.log I have this Regex now:

Regex      ^\<(?<pri>[0-9]*)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]+)(?<ident>[a-zA-Z0-9_\/\.\-]*) (?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.+)$

where need the facility? I means, this

syslog_severity_key:  severity
      syslog_facility_key:  facility

Github to the rescue: https://github.com/fluent/fluent-bit/issues/5088

Now it works as expected .. but why is it so complicated?