Skip to content

filebeat syslog input: permit space after <PRI> #13269

@candlerb

Description

@candlerb

Describe the enhancement:

Netgear switches send a space between the <PRI> and the timestamp fields in a syslog message. This is a violation of the standard, but it would be easy to accept.

Test case, based on packet captured using tcpdump from GS724Tv4:

echo -ne "<13> Aug 16 12:25:24 10.12.255.2-1 TRAPMGR[53034492]: traputil.c(696) 135956 %% Link Up: g5.\000" | nc -w0 -u localhost 5514

Current results:

  "message": "<13> Aug 16 12:25:24 10.12.255.2-1 TRAPMGR[53034492]: traputil.c(696) 135956 %% Link Up: g5.\u0000",

If the space was skipped, then the priority/facility, timestamp, program/pid could all be parsed.

(Aside: the messages also include a trailing null. This could also be stripped, but I don't object to retaining it)

Describe a specific use case for the enhancement or feature:

Networks with Netgear switches.

Metadata

Metadata

Assignees

No one assigned

    Labels

    FilebeatFilebeatTeam:Services(Deprecated) Label for the former Integrations-Services teamcandidateCandidate to be added to the current iterationenhancement

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions