# Syslog data

### Pre-Reqs

* Anvilogic account
* Snowflake data repository connected to your Anvilogic account
* [FluentBit installed](https://docs.fluentbit.io/manual/installation/getting-started-with-fluent-bit)

### Setting up FluentBit Config

1. Anvilogic will provide a S3 bucket and the corresponding access keys/ids (note these change for each integration) when you create a forward events integration in your Anvilogic deployment.
   1\.

   ```
   <figure><img src="https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2F5lAnQX3s5aICw996Rl7G%2FScreenshot%202024-09-09%20at%2010.51.50%E2%80%AFAM.png?alt=media&#x26;token=de60b215-21c5-4c3e-8de4-18c805358c09" alt=""><figcaption></figcaption></figure>
   ```
2. Create a credential file on the machine that fluentBit can read from. For example, `/home/<username>/creds` . Inside the file please paste the following config with your specific access key/id

```
[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
```

<figure><img src="https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2FX79vB1tREds6gCkZaXgx%2FScreenshot%202024-09-09%20at%2011.07.50%E2%80%AFAM.png?alt=media&#x26;token=0ab7336e-af5c-4801-9868-b16be303cb0f" alt=""><figcaption></figcaption></figure>

3. Since our credentials are already updated in the `/home/<username>/creds` file, we need to configure the service config file for Fluent Bit and set the path to this credential file (see image for reference). To do that, fire up your favorite text editor and edit the fluent-bit.service file located at /usr/lib/systemd/system/fluent-bit.service.
   1. `Environment="AWS_SHARED_CREDENTIALS_FILE=/home/<username>/creds"`

<figure><img src="https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2FDyvkw01tE9UFJybIvyE4%2FScreenshot%202024-09-09%20at%2011.08.59%E2%80%AFAM.png?alt=media&#x26;token=881f3980-8c2e-4188-934f-e41739c45e3f" alt=""><figcaption></figcaption></figure>

4. Then run the following commands in a terminal window
   1. `sudo systemctl daemon-reload`
   2. &#x20;`sudo systemctl start fluent-bit`
5. Next we need to configure fluentbit to read our logs and send them to S3. In this example, I will be sending logs via Syslog and sending them to S3.

```
[INPUT]
    Name              syslog
    Mode              udp
    Listen            0.0.0.0
    Port              1515
    Parser            syslog-rfc3164
    Mem_Buf_Limit     10MB

[OUTPUT]
    Name              s3
    Match             *
    bucket            avl-raw-prod-s3-221-24243202/sdi_custom_data-0
    region            us-east-1
    use_put_object    On
    Store_dir         /tmp/fluent-bit/s3
    s3_key_format     /$TAG/%Y/%m/%d/%H/%M/%S
```

Once you have pasted the above config into your fluentBit.conf file (typically located at /etc/fluent-bit/fluent-bit.conf)

* **NOTE**: You can also edit or add any of your own customer parsers for logs by editing the parser.conf file at /etc/fluent-bit/
* Once you have edited your fluent-bit.conf, please restart the fluentBit service `sudo systemctl restart fluent-bit`
  * You can validate that your config is working by heading to /tmp/fluent-bit/s3/ and looking inside that folder.

6. You can now confirm that data has landed in your snowflake account.&#x20;
   1\.

   ```
   <figure><img src="https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2FlvNdAfGtXWkfA1c0A9HS%2Fimage.png?alt=media&#x26;token=b4244204-f03f-4f89-bb40-fc160babaee3" alt=""><figcaption></figcaption></figure>

   <figure><img src="https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2FGkxvrFCXDXxRycJzvjOV%2Fimage.png?alt=media&#x26;token=d7964a7f-f8a3-468e-99d3-23baff6c3024" alt=""><figcaption></figcaption></figure>
   ```

Please update the input section of this example config to fit your exact needs.