We are in the process of ditching solarwinds kiwi syslog because its not performing, and is instable after every .net update. We mostly use syslog as an proxy between the customer network and our own datacenter where the siem is located.

One of the things we heavely use is an filter like log received from

host x.x.x.x message text contains " modsecurity "

then forward the log to our siem but with an bogus ip adres like 127.0.12.1 we use this to split the logs to seperate logsources is such a filter possible with NXLog (community) we want to purchase the software but need to build a poc first

what we want to accomplish first, before doing fancy stuff is

listen on udp port 514 , forward that logs to an remote syslog server

i was thinking it was something simple like :

<Input in>
    Module  im_udp
    Host    0.0.0.0
    Port    514
    Exec    parse_syslog();
</Input>

<Output outtcp>
    Module  om_tcp
    Host    10.202.5.10
    Port    530
    Exec    to_syslog_bsd();
</Output>

<Route 1>
    Path  in => out, outtcp
</Route>

but that doesn rly do anything