Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #23954 to 7.x: Add RFC5424 format support for syslog input #25116

Closed
wants to merge 1 commit into from
Closed

Cherry-pick #23954 to 7.x: Add RFC5424 format support for syslog input #25116

wants to merge 1 commit into from

Conversation

faec
Copy link
Contributor

@faec faec commented Apr 15, 2021 •
edited by zube bot
Loading

Cherry-pick of PR #23954 to 7.x branch. Original message:

What does this PR do?

Reopen from #20246
Resolves #6872
Add RFC5424 format support for syslog input

Why is it important?

Syslog input only support rfc3164, btw rfc3164 is obsoleted by rfc5424

More and more software is using rfc5424 instead of rfc3164.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

  • Syslog
    • inputs config support RFC5424
    • detect format automatically
  • Ragel
    • HEADER
      • PRI
      • VERSION
      • TIMESTAMP
      • HOSTNAME
      • APP-NAME
      • PROCID
      • MSGID
    • STRUCTURED-DATA
      • SD-ELEMENT
      • SD-ID
      • SD-PARAM
      • Change Control
    • MSG
  • TEST
    • all examples in RFC5424 document
    • Some special boundary case tests

How to test this PR locally

Related issues

closes # #6872

@wph95 @faec
Add RFC5424 format support for syslog input (elastic#23954)
c43cfa2 
* - add PRI schema
- add VERSION schema

* - make test work
- clean code
- change parser.go to parser/parser_rfc5424

* - Add TIMESTAMP format

* - Add "AppName" format
- Add "ProcID" format
- Add "MsgID" format
- Add "HostName" format
- improve test

* add STRUCTURED_DATA support

* add MESSAGE support

* - syslog input config support rfc5424
- add auto detect format

* add param value escape support

* - clean up the code
- add more test

* update mod

(cherry picked from commit 3953756)
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Apr 15, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/agent (Team:Agent)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Apr 15, 2021
@faec faec requested a review from ph April 15, 2021 17:24
@elasticmachine
Copy link
Collaborator

elasticmachine commented Apr 15, 2021 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: kuisathaverat commented: /test

  • Start Time: 2021-04-17T10:54:44.076+0000

  • Duration: 86 min 36 sec

  • Commit: c43cfa2

Trends 🧪

Image of Build Times

❕ Flaky test report

No test was executed to be analysed.

@kuisathaverat
Copy link
Contributor

/test

@faec faec closed this Apr 19, 2021
@zube zube bot removed the [zube]: Done label Jul 19, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ph ph ph approved these changes

Assignees
No one assigned
Labels
backport Team:Elastic-Agent Label for the Agent team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@faec @elasticmachine @kuisathaverat @ph @wph95