`@version: 3.35 source s_src { internal(); }; template NRFormat { template("newrelic_key_here <${PRI}>1 ${ISODATE} ${HOST:--} ${PROGRAM:--} ${PID:--} ${MSGID:--} ${SDATA:--} $MSG\n"); template_escape(no); }; destination d_newrelic { network("newrelic.syslog.nr-data.net" port(6514) transport("tls") tls(peer-verify(no)) template(NRFormat2) ); }; log { source(s_src); #source(s_files); ## in case step 4 is implemented. destination(d_newrelic); };` This template is expecting newrelic_licence_ley before <${PRI}>1 and logspout does not seem to support this.