User-Focused Images#

The official rsyslog image family provides layered container variants for custom builds, general-purpose forwarding, central collection, Docker log forwarding, and Vespa-oriented ETL pipelines.

Official images are built on Ubuntu LTS releases and install the latest rsyslog packages from the Adiscon daily-stable PPA. Images are tagged rsyslog/rsyslog[-<function>]:<version> where <version> follows the YYYY-MM rsyslog release.

Available variants include:

rsyslog/rsyslog-minimal – rsyslog core only.
rsyslog/rsyslog – standard image with common modules such as imhttp and omhttp.
rsyslog/rsyslog-collector – adds modules for centralized log collection, including RELP and optional TLS reception.
rsyslog/rsyslog-dockerlogs – includes imdocker to process logs from the Docker daemon.
rsyslog/rsyslog-etl – experimental image that receives syslog and forwards events to a Vespa HTTP endpoint using omhttp.
rsyslog/rsyslog-debug – planned variant with troubleshooting tools.

Sample container definitions include:

rsyslog/rsyslog-imbeats – concrete sample for receiving Elastic Agent and Filebeat output.logstash traffic with imbeats. This sample is not wired into published image builds yet.

Images are built using the layered Makefile in packaging/docker/rsyslog:

make all
make standard
make VERSION=2025-06 minimal

Configuration snippets in each directory and environment variables allow enabling or disabling functionality at runtime. Consult the packaging/docker README for the latest details and feedback instructions.

For a complete centralized logging stack with Loki, Grafana, Prometheus, and Traefik, see ROSI Collector. ROSI Collector uses the rsyslog/rsyslog-collector image as one component inside a larger Docker Compose deployment.

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project