Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
GitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
Base on Jochen recommendation https://groups.google.com/forum/#!searchin/graylog2/5424/graylog2/KO91vcZIOXo/vcEPEwAT6e4J
I would like to create issue:
I have an application which creates log in RFC5424 and send them to my central rsyslog server. Logs are resend to graylog2 via syslog protocol. Graylog2 runs local INPUT tcp syslog on 10514.
all logs are received by graylog2 without any issue but they are not parsed properly. They are parsed like basic RFC5424 message. Structured data are handled like "message".
the full message looks like:
I recieve message fields like:
but there should be other ones based on structured data.
I can confirm this behaviour (especially when you pass a NILVALUE (
Message on the wire:
... will have Graylog2 recognise the
See 6.5. Examples for an example.
I used modified syslog sender for testing.
@cybermedi There are several issues unfortunately.
I am currently investigating if we can fix the whitespace-in-value parsing issue in our syslog parser.
OK I added msgid to template. And it seems that that there is still something wrong with parsing. Structured data was not parsed, and the message begins with "-" (i think it is the msgid). In my message I have app-name I do not have procid and msgid, that's why raw messages contains:
OH I do not how to show it here, the first example has two spaces and the second three. Maybe I will need to have two templates for messages with structured data and one without. Maybe this issue should be fixed in rsyslog.
The new syslog4j version can handle whitespace in structured syslog values. Ref: #845
If there is structured stat in the syslog message, the structured data and the message ID should not be in the "message" field. There is still a problem if the syslog STRUCTURED-DATA field is a NILVALUE ("-"). Then the message plus the "-" for the nil value will end up in the "message" field. This needs to be solved in the syslog4j library. Refs: #845
@cybermedi The next beta (beta.2) will have a fix for the structured data parsing.
It will also remove the structured data from the message field.
@dfch If there is a NILVALUE for the structured data like you posted, the "- -" will still be in the message field. This is a shortcoming in the syslog parser which we cannot fix for 1.0 unfortunately.
See #872 for the pull request.
I am closing this ticket now. Please re-open if you still have issues with the next beta. Thank you for the report!