Destinations are the external systems that receive forwarded events. A destination is a target — a local JSON file, an HTTP/HTTPS endpoint, or a syslog server — that policies and routes point at.
¶ Supported destination types
- local_jsonl — append events as JSON lines to a local file (e.g.
/home/artica/auditd-events.jsonl). Ideal for a local Filebeat/Fluent Bit shipper or quick verification. - syslog_tcp / syslog_tcp_tls / syslog_udp — send to a syslog collector, optionally over TLS, in RFC 5424 format. This is the usual path to a SIEM (Wazuh, QRadar, Graylog, rsyslog).
- http_json / https_json — POST events as JSON to an HTTP endpoint, such as a Splunk HTTP Event Collector.
¶ What a destination contains
- Name and Enabled flag.
- Type and Format (
json,rfc5424orrfc5424_json). - Path (for
local_jsonl), Address + Port (for syslog), or URL (for HTTP).
¶ Testing a destination
Each row has a Test button that sends a synthetic event and reports success or the exact error (DNS failure, connection refused, TLS handshake problem, HTTP status). Use it to validate connectivity before you enable forwarding — a misconfigured destination will otherwise fill the dead-letter queue.