Currently, Telegraf only gets "*.notice" logs as an input
The outputs that are configurable are well supported for ingesting logs as well as the metrics that telegraf currently imports.
By default, the 50-telegraf.conf syslog configuration should pull in more logs, and avoid using rsyslog as the interface, so that Telegraf as a central process can be the single point of log/metric egress from n inputs to m outputs.
https://github.com/vyos/vyos-1x/pull/4279
Not sure how to actually link it here, don't think I have that permission.
I opened this mostly as a boilerplate because I think it's something valuable to have. I'm happy to run through tests if the maintainers think this is a valuable change, and I can probably expand a little bit on some of the j2. I don't want to waste time if it's something the maintainers don't agree with at a more fundamental level, I can just do the change in my local vyos with some post boot scripting.