Skip to content

fix(codecs): accept short-form syslog severity keywords in encoder#25731

Merged
pront merged 1 commit into
vectordotdev:masterfrom
vparfonov:fix-syslog-severity-aliases
Jul 1, 2026
Merged

fix(codecs): accept short-form syslog severity keywords in encoder#25731
pront merged 1 commit into
vectordotdev:masterfrom
vparfonov:fix-syslog-severity-aliases

Conversation

@vparfonov

Copy link
Copy Markdown
Contributor

Summary

The syslog codec's Severity enum only accepts full-form keywords ("critical", "emergency", "informational", etc.) but the VRL functions to_syslog_severity and to_syslog_level use short-form keywords ("crit", "emerg", "info", etc.). When a short-form value reaches the syslog encoder, FromStr parsing fails silently and the severity falls back to the default Informational (6).

This adds strum serialize aliases so the encoder accepts both forms:

  • emerg / emergency / panic → Emergency (0)
  • crit / critical → Critical (2)
  • err / error → Error (3)
  • warn / warning → Warning (4)
  • info / informational → Informational (6)

Vector configuration

How did you test this PR?

Extended the existing test_parsing_logic unit test in lib/codecs/src/encoding/format/syslog.rs

Change Type

  • Bug fix
  • New feature
  • Dependencies
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

Notes

  • Please read our Vector contributor resources.
  • Do not hesitate to use @vectordotdev/vector to reach out to us regarding this PR.
  • Some CI checks run only after we manually approve them.
    • We recommend adding a pre-push hook, please see this template.
    • Alternatively, we recommend running the following locally before pushing to the remote branch:
      • make fmt
      • make check-clippy (if there are failures it's possible some of them can be fixed with make clippy-fix)
      • make test
  • After a review is requested, please avoid force pushes to help us review incrementally.
    • Feel free to push as many commits as you want. They will be squashed into one before merging.
    • For example, you can run git merge origin master and git push.
  • If this PR introduces changes Vector dependencies (modifies Cargo.lock), please
    run make build-licenses to regenerate the license inventory and commit the changes (if any). More details on the dd-rust-license-tool.

The Severity enum only accepted full-form names (e.g. "critical",
"emergency", "informational") but the VRL functions to_syslog_severity
and to_syslog_level use short-form names ("crit", "emerg", "info").
This caused severity values to silently fall back to the default
"informational" when short-form keywords were used.

Add strum serialize aliases so the syslog encoder accepts both
short-form and full-form severity names: emerg/emergency, crit/critical,
err/error, warn/warning, info/informational, and the deprecated "panic"
alias.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@vparfonov vparfonov requested a review from a team as a code owner July 1, 2026 17:27
@pront pront enabled auto-merge July 1, 2026 19:15
@pront pront added this pull request to the merge queue Jul 1, 2026
Merged via the queue into vectordotdev:master with commit 3a8ff2a Jul 1, 2026
82 checks passed
@pront pront deleted the fix-syslog-severity-aliases branch July 1, 2026 20:07
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 1, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants