[BUG] Filebeat is unable to parse the syslog message when priority value is given as <0> in syslog message of format RFC 3164


(Debashis Mondal) #1

Observation:
It is observed that filebeat is unable to parse the syslog message of format RFC-3164 properly when priority value is given as <0> in syslog message. For other priorities filebeat is working as expected.

For the above reason filebeat syslog input will never able to parse syslog of Emergency kernal messages.

This is a major bug of filebeat syslog input plugin

Verification Version:
6.4.1 and 6.6.x

Execution Steps:
1. Enable "syslog" type prospector using "tcp" protocol in "filebeat.yml"
filebeat.inputs:
- type: syslog
enabled: true
protocol.tcp:
host: "localhost:9000"
2. Start filebeat
# filebeat -e
3. Connect and send data using tcp client to filebeat
# nc localhost 9000
<0>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8

Output observed in "syslog" field of parsed message:
...................
syslog:{}
...................

Expected value for "syslog" field of parsed message:
....................
"syslog": {
"priority": 0,
"severity_label": "Emergency",
"facility": 0,
"facility_label": "kernel"
},
....................

Important Note:
I have verified this in different filebeat versions as well as in currently stable 6.6.x version. It is not working.

I am able to identify some source code level mistake for the above scenario. I have locally fixed this issue in code and it is working fine.

So I am going to raise an issue in github as well as will upload the patch for the fix.

Kindly let me know for any suggestion.


(Noémi Ványi) #2

Indeed. Thank you for the report. We would be grateful if you opened a PR with your patch.


(Debashis Mondal) #3

Hi @kvch,
Thank you for confirmation.

I have raised an issue in github regarding this


(Debashis Mondal) #4

I have proposed a patch.

The PR is : https://github.com/elastic/beats/pull/11011

Currently it is pending for CLA. I will do this agreement asap.


(Noémi Ványi) #5

Thank you!


(Debashis Mondal) #6

I am going to close old pull request because of some base branch mismatch. New pull request is already created and approved by the reviewer.

Old PR : https://github.com/elastic/beats/pull/11011
New PR: https://github.com/elastic/beats/pull/11288


(system) closed #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.