syslog-ng syslog conf splunk

syslog-ng.conf

options {
    create-dirs(yes);

    owner("splunk");
    group("splunk");
    dir-owner("splunk");
    dir-group("splunk");
    dir-perm(0755);
    perm(0644);

    time-reopen(10);
    keep-hostname(yes);
    log-msg-size(65536);
};

source s_default {
    udp(ip("0.0.0.0") port(514));
    tcp(ip("0.0.0.0") port(514)); 
};

destination d_default { 
    file("/var/log/syslog-ng/$HOST/$YEAR-$MONTH-$DAY.log"); 
};

log { 
     source(s_default);
     destination(d_default);
};