fluent / fluent/fluent-plugin-grok-parser
Syslog TAGs exceeding 32 character will not grok
- Dominant language
- Ruby
- Stars
- 108
- Forks
- 32
- PR merge metrics
- No merged PRs in 30d
Description
Hello Everyone! I would like some feedback on an issue i've observed with syslog tags exceeding 32 characters. The syslog RFC defines a "TAG" in the syslog message (typically program name and pid) [must not exceed 32 characters](https://www.rfc-editor.org/rfc/rfc3164#section-4.1.3.).
Rsyslog will truncate any part of the TAG past 32 characters when shipping logs (at least on my systems Cent/Alma). Resulting in something like this:
```
original message:
<77>Aug 18 05:00:03 my-test-host run-parts(/etc/cron.daily)[25833]: finished prelink
what fluentd sees:
<77>Aug 18 05:00:03 my-test-host run-parts(/etc/cron.daily)[25833 finished prelink
```
You'll notice that `run-parts(/etc/cron.daily)[25833` is exactly 32 characters. I suggest a change to SYSLOGBASE that accounts for this in case rsyslog or any other shipping mechanism enforces the rfc standard. Something along the lines of:
```
SYSLOG_LONGTAG [\x21-\x5a\x5c\x5e-\x7e\x5b\x5d]{32}
SYSLOGPROG (%{PROG:[process][name]}(?:\[%{POSINT:[process][pid]:integer}\])?|%{SYSLOG_LONGTAG:syslog_longtag})
```
Thoughts? Kudos to @tlaberge-godaddy for finding this.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.