diff --git a/fluentd/files/match/syslog.conf b/fluentd/files/match/syslog.conf
new file mode 100644
index 0000000..bcc345d
--- /dev/null
+++ b/fluentd/files/match/syslog.conf
@@ -0,0 +1,48 @@
+  @type remote_syslog
+  host {{ values.host }}
+  port {{ values.get("port", 514) }}
+  host_with_port {{ values.host }}:{{ values.get("port", 514) }}
+  severity {{ values.get("severity", "debug") }}
+  facility {{ values.get("facility", "user") }}
+  program fluentd
+{%- if values.get("protocol") %}
+  protocol {{ values.protocol }}
+{%- endif %}
+{%- if values.get("tls") %}
+  tls {{ values.tls }}
+{%- endif %}
+{%- if values.get("ca_file") %}
+  ca_file {{ values.ca_file }}
+{%- endif %}
+{%- if values.get("verify_mode") %}
+  verify_mode {{ values.verify_mode }}
+{%- endif %}
+{%- if values.get("packet_size") %}
+  packet_size {{ values.packet_size }}
+{%- endif %}
+{%- if values.get("timeout") %}
+  timeout {{ values.timeout }}
+{%- endif %}
+{%- if values.get("timeout_exception") %}
+  timeout_exception {{ values.timeout_exception }}
+{%- endif %}
+{%- if values.get("keep_alive") %}
+  keep_alive {{ values.keep_alive }}
+{%- endif %}
+{%- if values.get("keep_alive_idle") %}
+  keep_alive_idle {{ values.keep_alive_idle }}
+{%- endif %}
+{%- if values.get("keep_alive_cnt") %}
+  keep_alive_cnt {{ values.keep_alive_cnt }}
+{%- endif %}
+{%- if values.get("keep_alive_intvl") %}
+  keep_alive_intvl {{ values.keep_alive_intvl }}
+{%- endif %}
+{%- if values.get("buffer") %}
+  <buffer>
+  {%- with values=values.get("buffer") %}
+    @type {{ values.get("type", "file") }}
+{% include "fluentd/files/buffer/" + values.get("type", "file") + ".conf" %}
+  {%- endwith %}
+  </buffer>
+{%- endif %}
diff --git a/metadata/service/agent/output/syslog.yml b/metadata/service/agent/output/syslog.yml
new file mode 100644
index 0000000..b78ed73
--- /dev/null
+++ b/metadata/service/agent/output/syslog.yml
@@ -0,0 +1,28 @@
+classes:
+- service.fluentd.agent.single
+parameters:
+  fluentd:
+    agent:
+      config:
+        label:
+          syslog_output:
+            filter:
+              add_general_fields:
+                tag: "**"
+                type: record_transformer
+                enable_ruby: true
+                record:
+                  - name: Type
+                    value: log
+                  - name: environment_label
+                    value: ${_param:cluster_domain}
+                  - name: Hostname
+                    value: ${fluentd:dollar}{ hostname }
+                  - name: Timestamp
+                    value: ${fluentd:dollar}{ time.strftime('%Y-%m-%dT%H:%M:%S.%N%z') }
+            match:
+              syslog_output:
+                tag: "**"
+                type: syslog
+                host: 127.0.0.1
+                port: 514