Graylog2 / Graylog2/graylog2-server
Incorrect parsing of RFC5424 syslog input
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Examples of lines which are not parsed correctly:
```
full_message
<34>1 2018-03-25T22:14:15.003Z mymachine.example.com su - ID47 - 'su root' failed for lonvick on /dev/pts/8
---
full_message
<131>1 2018-03-26T08:19:40.760962Z host_pac amstest_libamsloggingtools 11348 Log2 - (SyslogTCPLogSink.cpp:35) Value 16
```
First example line is taken directly from the [RFC5424 examples](https://tools.ietf.org/html/rfc5424#section-6.5), only the date has been modified and BOM removed (which is OK according to the [RFC5424 grammar](https://tools.ietf.org/html/rfc5424#section-6)).
## Expected Behavior
Fields `msg_id` (or similar) and `message` should be parsed out properly. For the first example message, I would expect `msg_id` to be `ID47` and `message` to be `'su root' failed for lonvick on /dev/pts/8`.
## Current Behavior
For the first example message, I get only `message` field:
```
message
ID47 - 'su root' failed for lonvick on /dev/pts/8
```
It seems that the input parser ignores the fact that the `-` in the original message is `STRUCTURED-DATA = NILVALUE` in the above mentioned grammar, not part of any message. In this example, there should be no `-` in the message at all. The `msg_id` field seems to be currently completely ignored by the Graylog.
Similarly in the second example, Graylog reports:
```
message
Log2 - (SyslogTCPLogSink.cpp:35) Value 16
```
But expected would be to have `msg_id` of `Log2` and message `(SyslogTCPLogSink.cpp:35) Value 16`.
## Steps to Reproduce (for bugs)
Just send above mentioned example messages to the graylog server.
## Context
The documentation [states](http://docs.graylog.org/en/2.4/pages/sending_data.html#syslog) that:
> Graylog is able to accept and parse RFC 5424...
But unfortunately, it is not able to parse even the example line from the mentioned RFC.
* Graylog Version: graylog:2.4.0-1
* Elasticsearch Version: elasticsearch:5.6.2
* MongoDB Version: mongo:3
* Operating System: Debian Stable
* Browser version: Firefox ESR 52.7.2
Contributor guide
Assessment
This issue has not been assessed yet.