> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://mezmo.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://mezmo.ferndocs.com/_mcp/server.

# Syslog over HTTP

## [Description](https://docs.mezmo.com/docs/syslog-over-http-pipeline-source#description)

You can send Syslog events and data to Mezmo Pipelines through an HTTP endpoint.

> The default syslog port is unavailable due to the lack of inherent security. HTTP forwarding is now a common practice for syslog via TLS to protect from packet sniffing and plain text transmission.

## [Configuration](https://docs.mezmo.com/docs/syslog-over-http-pipeline-source#configuration)

Use the standard HTTP endpoint for the configuration. Ensure that the encoding matches the configuration of your source.

> You must use a discrete parsing processor after the source in order to properly ingest the data and make it accessible to subsequent processors in a pipeline.

This example of an rsyslog configuration illustrates using a defined template to allow inclusion of the API key with the `omhttp` [output module documented here](https://www.rsyslog.com/doc/v8-stable/configuration/modules/omhttp.html).

```bash
module(load="omhttp")
template(name="tpl1" type="string" string="{\"type\":\"syslog\", \"host\":\"%HOSTNAME%\"}")
action(
    type="omhttp"
    server="pipeline.app.mezmo.com"
    serverport="443"
     httpheaders=[
        "Authorization: <TOKEN>"
    ]
    template="tpl1"
    action.resumeRetryCount="100"
    batch="on"
    batch.format="jsonarray"
    batch.maxsize="10"
)
```

| Option          | Description                                                  |
| --------------- | ------------------------------------------------------------ |
| Decoding Method | The decoding method to use to convert frames to data events. |