Sending logs

There are three ways in: an access token over HTTPS (apps), syslog (devices), and the command line. See also Sources and tokens and Parsers.

From an app

On the Sources page, choose Add source, name it after the app and optionally pick a parser. The next screen, Connect, shows the address to send logs to (<address>/api/v1/logs), the access token, which is shown once, and a snippet that sends a log in curl, Python, Go, JavaScript or React, with the address and token already filled in. The address starts as the one in your browser; change it to the address your apps use to reach SIEMLite if that differs. Tokens can only send logs; they can't search or sign in.

The snippets trust siemlite.crt, since the certificate is self-signed unless you supplied your own. Copy it next to the code (docker compose cp siemlite:/data/siemlite.crt . with Docker) and remove those lines if your certificate is already trusted. A log sent returns 202 when accepted, 401 if the token is wrong or the source is disabled, and 503 with Retry-After when SIEMLite is busy: wait that many seconds, then send again.

The React example goes through your own backend. A token in front-end code is public, and SIEMLite doesn't allow cross-origin browser calls (it answers a browser's preflight request with 405, so the browser blocks the call). The page sends the log to a route on your server, such as /api/log, and the server adds the token and forwards it.

From the command line:

./siemlite keys create -name myapp

Then post logs, one per line. A body that is all JSON (pretty-printed objects, or arrays of them) is read one object at a time instead, so an app can send its JSON logs as it prints them:

curl --cacert siemlite.crt -X POST 'https://localhost:8443/api/v1/logs?source=myapp' \
  -H "Authorization: Bearer $SIEMLITE_KEY" \
  --data-binary @app.log

Or post structured OCSF events:

curl --cacert siemlite.crt -X POST https://localhost:8443/api/v1/events \
  -H "Authorization: Bearer $SIEMLITE_KEY" \
  -d '[{"category_uid":3,"class_uid":3002,"severity_id":4,
        "message":"Failed password for root","src_endpoint":{"ip":"203.0.113.7"}}]'

If the app connects with a hostname or IP other than localhost, start SIEMLite with -tls-hosts listing it before the certificate is first generated, so the certificate matches.

Syslog

Point rsyslog, syslog-ng, firewalls, switches or anything else that speaks syslog at SIEMLite:

./siemlite -syslog-udp :514 -syslog-tcp :514 -syslog-tls :6514

UDP (RFC 5426), TCP (RFC 6587; octet-counted or newline-delimited frames) and TLS (RFC 5425, using the same certificate as the web UI). Each listener is off unless its flag is set.
Syslog has no authentication, so only senders on loopback and private networks (10/8, 172.16/12, 192.168/16, 100.64/10, fc00::/7, link-local) are accepted by default. Set -syslog-allow 192.0.2.0/24,198.51.100.4 to choose exactly who may send; refused senders are counted and logged once a minute.
The syslog hostname becomes the event's host and the app name or tag (sshd[311]:) its source. The sender's address is kept as device.ip.
Messages over 64 KiB are dropped. With UDP, messages are dropped when the ingest queue is full; TCP waits briefly.
Ports below 1024 need root or sudo setcap cap_net_bind_service=+ep ./siemlite.

rsyslog example (/etc/rsyslog.d/siemlite.conf): *.* @@siemlite.internal:514 (TCP; one @ for UDP).