The simplest configuration accepts system logs from /dev/log (from applications or forwarded by systemd) and writes everything to a single file: @version: current @include "scl.conf" log { source { ...