Skip to content

Commit d4857f7

Browse files
sugaf1204sugaf1204
committed
[pkg/stanza][receiver/syslogreceiver] Add syslog priority/facility text option
1 parent e0f7b93 commit d4857f7

File tree

7 files changed

+60
-5
lines changed

7 files changed

+60
-5
lines changed

‎pkg/stanza/docs/operators/syslog_parser.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ The `syslog_parser` operator parses the string-type field selected by `parse_fro
1515
| `location` | `UTC` | The geographic location (timezone) to use when parsing the timestamp (Syslog RFC 3164 only). The available locations depend on the local IANA Time Zone database. [This page](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) contains many examples, such as `America/New_York`. |
1616
| `enable_octet_counting` | `false` | Wether or not to enable [RFC 6587](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.1) Octet Counting on syslog parsing (Syslog RFC 5424 only). |
1717
| `allow_skip_pri_header` | `false` | Allow parsing records without the PRI header. If this setting is enabled, messages without the PRI header will be successfully parsed. The `severity` and `severity_text` fields as well as the `priority` and `facility` attributes will not be set. If this setting is disabled (the default), messages without PRI header will throw an exception. To set this setting to `true`, the `enable_octet_counting` setting must be `false`.|
18+
| `priority_facility_to_text` | `false` | Convert `priority` and `facility` attributes to syslog keyword strings (`priority` uses severity short levels like `crit`, and `facility` uses facility keywords like `auth`). |
1819
| `non_transparent_framing_trailer` | `nil` | The framing trailer, either `LF` or `NUL`, when using [RFC 6587](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.2) Non-Transparent-Framing (Syslog RFC 5424 only). |
1920
| `timestamp` | `nil` | An optional [timestamp](../types/timestamp.md) block which will parse a timestamp field before passing the entry to the output operator |
2021
| `severity` | `nil` | An optional [severity](../types/severity.md) block which will parse a severity field before passing the entry to the output operator |

‎pkg/stanza/operator/parser/syslog/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ type BaseConfig struct {
5454
Location string `mapstructure:"location,omitempty"`
5555
EnableOctetCounting bool `mapstructure:"enable_octet_counting,omitempty"`
5656
AllowSkipPriHeader bool `mapstructure:"allow_skip_pri_header,omitempty"`
57+
PriorityFacilityToText bool `mapstructure:"priority_facility_to_text,omitempty"`
5758
NonTransparentFramingTrailer *string `mapstructure:"non_transparent_framing_trailer,omitempty"`
5859
MaxOctets int `mapstructure:"max_octets,omitempty"`
5960
}
@@ -105,6 +106,7 @@ func (c Config) Build(set component.TelemetrySettings) (operator.Operator, error
105106
location: location,
106107
enableOctetCounting: c.EnableOctetCounting,
107108
allowSkipPriHeader: c.AllowSkipPriHeader,
109+
priorityFacilityToText: c.PriorityFacilityToText,
108110
nonTransparentFramingTrailer: c.NonTransparentFramingTrailer,
109111
maxOctets: c.MaxOctets,
110112
}, nil

‎pkg/stanza/operator/parser/syslog/config_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,15 @@ func TestUnmarshal(t *testing.T) {
4040
return cfg
4141
}(),
4242
},
43+
{
44+
Name: "priority_facility_to_text",
45+
Expect: func() *Config {
46+
cfg := NewConfig()
47+
cfg.Protocol = RFC3164
48+
cfg.PriorityFacilityToText = true
49+
return cfg
50+
}(),
51+
},
4352
{
4453
Name: "location",
4554
Expect: func() *Config {

‎pkg/stanza/operator/parser/syslog/parser.go‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ type Parser struct {
3333
location *time.Location
3434
enableOctetCounting bool
3535
allowSkipPriHeader bool
36+
priorityFacilityToText bool
3637
nonTransparentFramingTrailer *string
3738
maxOctets int
3839
}
@@ -144,9 +145,14 @@ func (p *Parser) parseRFC3164(syslogMessage *rfc3164.SyslogMessage, skipPriHeade
144145
}
145146

146147
if !skipPriHeaderValues {
147-
value["priority"] = syslogMessage.Priority
148148
value["severity"] = syslogMessage.Severity
149-
value["facility"] = syslogMessage.Facility
149+
if p.priorityFacilityToText {
150+
value["priority"] = syslogMessage.SeverityShortLevel()
151+
value["facility"] = syslogMessage.FacilityLevel()
152+
} else {
153+
value["priority"] = syslogMessage.Priority
154+
value["facility"] = syslogMessage.Facility
155+
}
150156
}
151157

152158
return p.toSafeMap(value)
@@ -166,9 +172,14 @@ func (p *Parser) parseRFC5424(syslogMessage *rfc5424.SyslogMessage, skipPriHeade
166172
}
167173

168174
if !skipPriHeaderValues {
169-
value["priority"] = syslogMessage.Priority
170175
value["severity"] = syslogMessage.Severity
171-
value["facility"] = syslogMessage.Facility
176+
if p.priorityFacilityToText {
177+
value["priority"] = syslogMessage.SeverityShortLevel()
178+
value["facility"] = syslogMessage.FacilityLevel()
179+
} else {
180+
value["priority"] = syslogMessage.Priority
181+
value["facility"] = syslogMessage.Facility
182+
}
172183
}
173184

174185
return p.toSafeMap(value)

‎pkg/stanza/operator/parser/syslog/syslogtest/data.go‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,34 @@ func CreateCases(basicConfig func() *syslog.Config) ([]Case, error) {
141141
true,
142142
true,
143143
},
144+
{
145+
"RFC3164PriorityFacilityToText",
146+
func() *syslog.Config {
147+
cfg := basicConfig()
148+
cfg.Protocol = syslog.RFC3164
149+
cfg.Location = location["utc"].String()
150+
cfg.PriorityFacilityToText = true
151+
return cfg
152+
}(),
153+
&entry.Entry{
154+
Body: fmt.Sprintf("<34>%s 1.2.3.4 apache_server: test message", ts.Format("Jan _2 15:04:05")),
155+
},
156+
&entry.Entry{
157+
Timestamp: time.Date(ts.Year(), ts.Month(), ts.Day(), ts.Hour(), ts.Minute(), ts.Second(), 0, location["utc"]),
158+
Severity: entry.Error2,
159+
SeverityText: "crit",
160+
Attributes: map[string]any{
161+
"appname": "apache_server",
162+
"facility": "auth",
163+
"hostname": "1.2.3.4",
164+
"message": "test message",
165+
"priority": "crit",
166+
},
167+
Body: fmt.Sprintf("<34>%s 1.2.3.4 apache_server: test message", ts.Format("Jan _2 15:04:05")),
168+
},
169+
true,
170+
true,
171+
},
144172
{
145173
"RFC3164Detroit",
146174
func() *syslog.Config {

‎pkg/stanza/operator/parser/syslog/testdata/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ rfc3164:
66
rfc5424:
77
type: syslog_parser
88
protocol: rfc5424
9+
priority_facility_to_text:
10+
type: syslog_parser
11+
protocol: rfc3164
12+
priority_facility_to_text: true
913
location:
1014
type: syslog_parser
1115
protocol: rfc5424

‎receiver/syslogreceiver/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ Parses Syslogs received over TCP or UDP.
2727
| `enable_octet_counting` | `false` | Whether or not to enable [RFC 6587](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.1) Octet Counting on syslog parsing (Syslog RFC 5424 and TCP only). |
2828
| `max_octets` | `8192` | The maximum octets for messages using [RFC 6587](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.1) Octet Counting on syslog parsing (Syslog RFC 5424 and TCP only). |
2929
| `allow_skip_pri_header` | `false` | Allow parsing records without the PRI header. If this setting is enabled, messages without the PRI header will be successfully parsed. The `SeverityNumber` and `SeverityText` fields as well as the `priority` and `facility` attributes will not be set on the log record. If this setting is disabled (the default), messages without PRI header will throw an exception. To set this setting to `true`, the `enable_octet_counting` setting must be `false`. |
30+
| `priority_facility_to_text` | `false` | Convert `priority` and `facility` attributes to syslog keyword strings (`priority` uses severity short levels like `crit`, and `facility` uses facility keywords like `auth`). |
3031
| `non_transparent_framing_trailer` | `nil` | The framing trailer, either `LF` or `NUL`, when using [RFC 6587](https://www.rfc-editor.org/rfc/rfc6587#section-3.4.2) Non-Transparent-Framing (Syslog RFC 5424 and TCP only). |
3132
| `attributes` | {} | A map of `key: value` labels to add to the entry's attributes |
3233
| `resource` | {} | A map of `key: value` labels to add to the entry's resource |
@@ -155,4 +156,3 @@ receivers:
155156
protocol: rfc3164
156157
location: UTC
157158
```
158-

0 commit comments

Comments
 (0)