LogShipper

LogShipper is a software component designed to collect log data from local sources and forward it to centralized logging backends. It is commonly deployed as an agent on host machines, inside containers, or as a sidecar in containerized environments. The goal is reliable, scalable delivery of logs to a central repository or processing pipeline.

Core capabilities typically include support for multiple input sources such as filesystem log files, syslog streams, Windows Event Logs, and container logs; parsing and enrichment to normalize timestamps and extract fields; filtering and transformation to redact sensitive data or reformat records; routing to one or more outputs, including cloud or on-premises logging platforms. They also implement buffering and retry logic to cope with network or backend outages, support batching and compression to improve throughput, and provide security features such as TLS encryption and authentication.

Deployment and architecture: LogShipper is usually implemented as a lightweight agent or daemon that runs on a host or in a container. In Kubernetes environments it may be deployed as a DaemonSet or as a sidecar. Configuration is typically file-based or API-driven, allowing centralized management in larger deployments. Observability features such as metrics and health checks are common.

Origins and usage: the term LogShipper describes a common pattern rather than a single, canonical product; multiple projects and vendors have used the name for components that perform log collection and forwarding. Log shippers are a core element of centralized logging stacks, which also include collectors or processors, storage backends, and user interfaces for search and analysis.