elastic / elastic/logstash

New syslog codec

Open
#3,825 4 comments 2 reactions 0 assignees View on GitHub
enhancement meta new plugin
Dominant language
Java
Stars
14.9k
Forks
3.5k
Avg merge
19h 14m
Merged PRs (30d)
63

Description

Create a new syslog codec to add support for [RFC3164](https://tools.ietf.org/html/rfc3164) and [RFC5424](https://tools.ietf.org/html/rfc5424) (with continued ISO8601 date format support) so it can be used with any input like TCP, UDP, HTTP and so on. Plan is to deprecate the current syslog input plugin since it only supports RFC3164 and is not flexible.

The cardinality and locations of format divergence are extremely vast especially around the many networking manufacturers. Formats that diverge from the standard RFC3164 (old) and RFC5424 (newer) will require custom grok patterns to successfully parse in the Logstash ecosystem. The intent is to ubiquitously support these two popular formats standardized by centralized logging systems/forwarders like syslog-ng, rsyslog, nxlog, Kiwi syslog server, and other types of application loggers like syslog4j and Ruby syslog.
- [ ] RFC3164: https://github.com/logstash-plugins/logstash-input-syslog/issues/15
- [ ] RFC5424: https://github.com/logstash-plugins/logstash-input-syslog/issues/14
- [ ] Resolve any other important issues in the syslog input plugin: https://github.com/logstash-plugins/logstash-input-syslog/issues

Related: https://github.com/elastic/logstash/issues/1667

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.