rsyslog

The rocket-fast system for log processing pipelines

rsyslog

The rocket-fast system for log processing pipelines

Native OpenTelemetry Export Arrives: Introducing the omotlp Output Module

Rainer Gerhardsopen telemetry

With the latest merge into the rsyslog development branch, rsyslog now provides a native OpenTelemetry (OTLP/HTTP) log exporter. The new omotlp output module enables rsyslog to send logs directly to any OTLP-compliant collector without the need for sidecars or protocol translators.

Minimalist diagram: an rsyslog server sends a stream of blue log packets to abstract purple OTLP collector nodes on a dark background.

This is Phase 1 of the OpenTelemetry integration. It focuses on the OTLP/HTTP JSON transport, including batching, retry semantics, TLS/mTLS, and proxy support. Additional transport variants (gRPC and HTTP/protobuf) may follow in future phases.

The module will become available shortly through the official rsyslog project packages as well as the project container images.

Key Capabilities

omotlp implements the OpenTelemetry log data model and provides a configurable, production-oriented transport layer.

Transport and Delivery

  • Native OTLP/HTTP JSON export
  • Configurable batching (count, byte size, timeout)
  • Backoff and retry handling for 429/5xx responses
  • Optional gzip compression
  • Full TLS/mTLS support
  • HTTP, HTTPS, and SOCKS proxy support

Metadata and Mapping

  • Template-driven log body generation
  • Full resource attributes via JSON
  • Attribute and severity mapping
  • Trace correlation (trace ID, span ID, trace flags)

Observability

The module exposes per-instance statistics via impstats, including:

  • batches submitted, successful, retried, and dropped
  • HTTP 4xx and 5xx counts
  • total records sent
  • cumulative HTTP request latency

Configuration and Availability

The module is off by default and must be explicitly enabled at build time:

./configure --enable-omotlp

Upcoming project packages and the official container images will ship with omotlp enabled.

A minimal configuration example:

module(load="omotlp")

action(
  type="omotlp"
  endpoint="http://otel-collector:4318"
  path="/v1/logs"
)

Early Adopters Welcome

We are actively looking for early adopters. If you plan to integrate OpenTelemetry log pipelines with rsyslog, we are happy to support you during evaluation and onboarding. Feedback from these deployments will directly shape the next stages of the module, including new transports and advanced features.

rsyslog as a Syslog to OpenTelemetry Forwarder

With imtcp, imudp, or any other input module, rsyslog can now act as a native syslog-to-OpenTelemetry gateway. This covers traditional infrastructure, appliances, legacy systems, and cloud workloads that still speak syslog.

Example configuration:

module(load="imtcp")
module(load="imudp")
module(load="omotlp")

input(type="imtcp" port="514")
input(type="imudp" port="514")

action(
  type="omotlp"
  endpoint="http://otel-collector:4318"
  path="/v1/logs"
  batch.max_items="200"
  batch.timeout.ms="2000"
  compression="gzip"
)

Looking Ahead

OpenTelemetry is becoming the standard interface for log ingestion across cloud and Kubernetes environments. Well, many say it already is. With omotlp, rsyslog integrates directly into these pipelines and provides a high-performance, low-overhead path from syslog to OTLP.

Feedback from early deployments will guide further development, including gRPC export, protobuf support, and additional optimizations.

Want more details?

See the actual PR on github.

Scroll to top