I see the follow doc from cloudfoundry document Service-Specific Instructions for Streaming Application Logs:
Logentries is Not Supported
Cloud Foundry distributes log messages over multiple servers in order to handle load. Currently, we do not recommend using Logentries as it does not support multiple syslog sources.
and I guess it points to Logentries feature Plaintext TCP/UDP input types.
So how about Logentries Token-based TCP input? E.g., configures provided token for each log messages send to STDOUT or STDERR from application or cloudfoundry. If this works, how to make it?
It sounds like you were trying to use port based syslog forwarding, which locks onto one IP address. Instead, you can use a syslog forwarder in combination with token forwarding to send your logs to us, you receive one token for one log, and if you want to route your logs to different logs/log sets, you'll have to manage multiple tokens in your config file.
Here are some documents you will find helpful: https://logentries.com/doc/input-token/3 https://blog.logentries.com/2014/01/how-to-send-log-data-via-a-proxy-server-using-rsyslog/2