Invalid Loki output generation for syslog-ng

[bonnQvantum]

Describe the bug:
I am currently evaluating logging-operator with syslog-ng and a Loki log database.
For this I created a SyslogNGClusterOutput following the example from the documentation, which leads to a failing config check. The resource definition and log output can be found below.

Expected behaviour:
The logging-operator generates a valid configuration.

Steps to reproduce the bug:
Create a SyslogNGClusterOutput as described below.

Additional context:
Smaller examples also fail, for example only configuring the URL.
The resulting configuration then contains timestamp("current"), which is also not valid.

There is a test which explicitly tests this behaviour, but the syslog-ng loki output grammar does not seem to support this.

Environment details:

• Kubernetes version: 1.26.6
• Cloud-provider/provisioner: kind
• logging-operator version: 4.4.0
• Install method: helm
• Logs from the misbehaving component:

Error parsing within destination, syntax error, unexpected LL_STRING, expecting KW_CURRENT or KW_RECEIVED or KW_MSG in /etc/syslog-ng/config/syslog-ng.conf:20:206-20:211:
15      
16      destination "clusteroutput_logging_loki-output" {
17          loki(auth(insecure()) labels(
18              "app" => "$PROGRAM"
19              "host" => "$HOST"
20---->     ) url("http://loki-write.logging.svc.cluster.local:3100") batch-lines(2000) batch-timeout(10) workers(3) persist_name("clusteroutput_logging_loki-output") log-fifo-size(1000) timestamp("msg") template("$ISODATE $HOST $MSGHDR$MSG"));
20---->                                                                                                                                                                                                      ^^^^^
21      };

• Resource definition (possibly in YAML format) that caused the issue, without sensitive data:

apiVersion: logging.banzaicloud.io/v1beta1
kind: SyslogNGClusterOutput
metadata:
 name: loki-output
spec:
  loki:
    url: http://loki-write.logging.svc.cluster.local:3100
    batch-lines: 2000
    batch-timeout: 10
    workers: 3
    log-fifo-size: 1000
    labels:
      "app": "$PROGRAM"
      "host": "$HOST"
    timestamp: "msg"
    template: "$ISODATE $HOST $MSGHDR$MSG"
    auth:
      insecure: {}

/kind bug

[kristofgyuracz]

Hi @bonnQvantum,
This config should be valid, and will be fixed in syslog-ng. I'll update this issue when the release containing the fix is out.

[kristofgyuracz]

Hi @bonnQvantum,
Here's an RC with the patch included: https://github.com/kube-logging/logging-operator/releases/tag/4.4.2-rc1

[bonnQvantum]

Hi @kristofgyuracz, thanks for quick fix! 👍

[pepov]

we have a few improvements landed in https://github.com/kube-logging/logging-operator/releases/tag/4.5.0 and written a blog post as well, let us know if you have any questions on our discord or in github discussions