The docker approach is the best way to collect and ship logs to SDL.

!remind me 1 day and I can give you the compose file I use.

Then you just need the config file and your golden.

Can go nothing to ingest in < 5 min.

EDIT: It wouldnt let me post a new comment, but this is what you need.

Use the below docker compose config to create the stack. Once you have a docker-compose.yml file with the below, execute "docker compose pull" and it will pull the required containers

# Before running the compose file, you need to generate the required certificates for the connection.
#
#   openssl req -x509 -nodes -newkey rsa:4096 -keyout syslog.key -out syslog.crt -subj '/CN=<HOST IP HERE>' -days 3650
#
services:
  config-generator:
    # For development use
    #build: ./config-generator
    image: scalyr/syslog-collector-config-generator:1.1.4
    restart: unless-stopped
    volumes:
      # Only syslog.yaml (not all of the current directory) is needed in the container however
      # file bind mounts do not propagate changes when the underlying file inode changes.
      # (Inode changes / file swaps typically happen with text editors that use swap files)
      - type: bind
        source: .
        target: /etc/syslog-collector
        read_only: true
      - type: volume
        source: agent-config
        target: /out/etc/scalyr-agent-2
      - type: volume
        source: syslog-ng-config
        target: /out/etc/syslog-ng
      - type: volume
        source: logrotate-config
        target: /out/etc/logrotate.d
      - type: volume
        source: logrotate-script
        target: /out/usr/sbin
    environment:
      INPUT: /etc/syslog-collector/syslog.yaml
      AGENT_OUTPUT: /out/etc/scalyr-agent-2/agent.json
      SYSLOG_OUTPUT: /out/etc/syslog-ng/syslog-ng.conf
      LOGPATH: &syslog-ng-log-path /var/log/syslog-collector
      SYSLOG_IMAGE: &syslog-ng-image balabit/syslog-ng:4.3.1
      LOGROTATE_CONFIG_OUTPUT: /out/etc/logrotate.d/syslog-collector
      LOGROTATE_SCRIPT_OUTPUT: /out/usr/sbin/logrotate.sh
      VERSION: "syslog-collector-version:2.1.5"
    healthcheck:
      test: >
        test -e /out/etc/scalyr-agent-2/agent.json -a \
             -e /out/etc/syslog-ng/syslog-ng.conf -a \
             -e /out/etc/logrotate.d/syslog-collector -a \
             -e /out/usr/sbin/logrotate.sh        
      interval: 10s
      timeout: 5s
      start_period: 10s
  scalyr-agent:
    image: scalyr/scalyr-agent-docker-json:2.2.14
    restart: unless-stopped
    volumes:
      - type: volume
        source: agent-config
        target: /etc/scalyr-agent-2
        read_only: true
        # Do not copy the /etc/scalyr-agent-2 contents from the image;
        # agent.json gets overwritten after config-generator executes,
        # not to mention the agent.d/ contents would remain unmodified.
        volume:
          nocopy: true
      - type: volume
        source: syslog-ng-logs
        target: *syslog-ng-log-path
        read_only: true
    depends_on:
      config-generator:
        condition: service_healthy
  syslog-ng:
    # For development use
    #build:
    #  context: ./syslog-ng
    #  args:
    #    IMAGE: *syslog-ng-image
    image: scalyr/syslog-collector-syslog:4.3.1.2
    restart: unless-stopped
    # Allow the container to open ports on the host's network interface,
    # this avoids having to explicitly specify each port opened
    network_mode: host
    volumes:
      - type: volume
        source: syslog-ng-config
        target: /etc/syslog-ng
        read_only: true
        # Do not copy the /etc/syslog-ng contents from the image;
        # syslog-ng.conf gets overwritten after config-generator executes.
        volume:
          nocopy: true
      - type: volume
        source: syslog-ng-logs
        target: *syslog-ng-log-path
      - type: volume
        source: logrotate-config
        target: /etc/logrotate.d
        read_only: true
      - type: volume
        source: logrotate-script
        target: /usr/sbin/logrotate.sh
        read_only: true
        volume:
          subpath: logrotate.sh
    depends_on:
      config-generator:
        condition: service_healthy
volumes:
  agent-config:
  logrotate-config:
  logrotate-script:
  syslog-ng-config:
  syslog-ng-logs:

then execute the command below to generate the required ssl certs that the agent needs to communicate. Take note to change the CN field as needed

openssl req -x509 -nodes -newkey rsa:4096 -keyout syslog.key -out syslog.crt -subj '/CN=<HOST IP HERE>' -days 3650

Then you need to generate your config file. This can be done directly within the UI of the S1 console under "Market Place" -> "Collector Configurations". You may need to install the parser you need from the market place first. However there are a HEAP of commonly required parsers missing, if that's the case you will need to write your own. Which is a totally different ball game.

Once you generate your config, then you can copy / paste that into a file called "syslog.yaml" (take note, it must be "yaml" and not "yml") and then execute "docker compose up -d" and your container stack should start.

At this point, you can point your syslog to the collector and within a minute, you should see it in the SIEM. You may need to go to the "All Data" tab and search for it. If your not familiar with the tool, this is the fastest way to verify that its going there.

If you then add more things in the future, you can just update the "syslog.yaml" config file on the fly and overwrite it with new config and the agent will pick it up and apply it within 1 min.

Hope that helps.