Counting What You Care About in Your Security Data Pipeline

Learn how to transform traditional syslog systems from opaque, fixed-format metric exporters into programmable, user-defined observability platforms in this conference talk from KubeCon + CloudNativeCon. Discover AxoSyslog's innovative approach to moving beyond CSV-style global metrics to full Prometheus integration, enabling users to emit fine-grained, label-rich metrics directly from log processing logic. Explore the transition from static system artifacts to dynamic, programmable views that track what actually matters to users, such as per-tenant message volume, custom log labeling, and field presence monitoring. Examine the historical limitations of syslog metrics, understand the native Prometheus integration journey, and see how the update_metric() function enables powerful real-world applications for debugging and policy enforcement. Gain insights into making observability accessible in traditional infrastructure components while empowering users to create their own custom metrics within security data pipelines.