This article shows how to collect syslog data into InfluxDB using Fluentd.


  • A basic understanding of Fluentd
  • A running instance of rsyslogd

In this guide, we assume we are running td-agent (Fluentd package for Linux and OSX) on Ubuntu Precise.

Step 1: Install InfluxDB

InfluxDB supports Ubuntu, RedHat and OSX (via brew). See here for the details.

Since we are assumed to be on Ubuntu, the following two lines install InfluxDB:

$ wget
$ sudo dpkg -i influxdb_latest_amd64.deb

Once it is installed, you can run it with

$ /etc/init.d/influxdb start

Then, go to localhost:8083 (or wherever you are hosting InfluxDB) to access InfluxDB's web console.

The default user/password are both "root". Once you log in, create a database called "test". This is where we will be storing syslog data.

If you prefer command line or cannot access port 8083 from your local machine, running the following command creates a database called "test".

$ curl -X POST 'http://localhost:8086/db?u=root&p=root' -d '{"name": "test"}'

We are done for now.

Step 2: Install Fluentd and the InfluxDB plugin

On your aggregator server, set up Fluentd. See here for the details.

$ curl -L | sh 

Next, the InfluxDB output plugin needs to be installed. Run

/usr/sbin/td-agent-gem install fluent-plugin-influxdb

If you are using vanilla Fluentd, run

fluent-gem install fluent-plugin-influxdb

You might need to sudo to install the plugin.

Finally, configure /etc/td-agent/td-agent.conf as follows.

  type syslog
  port 42185
  tag  system

<match system.*.*>
  type influxdb
  dbname test
  flush_interval 10s # for testing.
  host YOUR_INFLUXDB_HOST (localhost by default)
  port YOUR_INFLUXDB_PORT (8086 by default)

Restart td-agent with sudo service td-agent restart.

Step 3: Configure rsyslogd

If remote rsyslogd instances are already collecting data into the aggregator rsyslogd, the settings for rsyslog should remain unchanged. However, if this is a brandnew setup, start forward syslog output by adding the following line to /etc/rsyslogd.conf

*.* @

You should replace "" with the IP address of your aggregator server. Also, there is nothing special about port 42185 (do make sure this port is open though).

Now, restart rsyslogd.

$ sudo service rsyslog restart

Step 4: Confirm Data Flow

Your syslog data should be flowing into InfluxDB every 10 seconds (this is configured by flush_interval).

Clicking on "Explore Data" brings up the query interface that lets you write SQL queries against your log data.

Here, I am counting the number of lines of syslog messages per facility/priority:

SELECT COUNT(ident) FROM /^system\./ GROUP BY time(1s)

Click on "Execute Query" and you get a graph like this.

Here is another screenshot just for the series.

What's Next?

Interested in other data sources and output destinations? Check out the following resources:

Get Started

Ready to try? Download Fluentd and start collecting more data!


Get the Fluentd Newsletter


Want to learn the basics of Fluentd? Check out these pages.

Ask the Community

Couldn't find enough information? Let's ask the community!