Update syslog input plugin

[leodido]

Feature Request

Hello folks! 🤗

I'm opening this issue to notify y'all that some days ago I finally completed a (first, initial) parser for BSD-syslog messages (see rfc3164). My friend @goller then released v3 for go-syslog to include it.

This issue is to request that the syslog input plugin gets updated to go-syslog v3.

Proposal:

1. Updating the go-syslog version being used to v3
2. Adapting the current syslog input plugin to the new interfaces
3. Adapt plugin configuration to support RFC3164 parsing
   3.1 Take into account the various parsing options it provides

Current behavior:

Depending on go-syslog v2.

Supporting RFC5424 parsing, with octect-counting or with non-transparent framing technique.

Desired behavior:

Depending on go-syslog v3.

Supporting RFC3164 parsing (with tunable options), too.

Use case:

Should unblock (at least, partially, depending on the "kind" of BSD-syslog messages people wants to parse) issue #4593 - Blocking #4593

Also refs to #4902

[danielnelson]

Thanks Leo! Is this update you would like to work on or would you rather we handle it?

[leodido]

Hey @danielnelson! At the moment, I don't think to have time to handle it so it depends on you folks!

[patn03]

@danielnelson

Is there a work around to this? I'm assuming this would be why my network gear and Solarwinds Log Forwarders for windows are failing? Anything using Rsyslog is working correctly but all items using Syslog clients directly to the Telegraf Instance are getting the errors below.

Telegraf v1.13.4

UDP Client
[inputs.syslog] Error in plugin: expecting a version value in the range 1-999 [col X]
and TCP Client
[inputs.syslog] Error in plugin: found ILLEGAL(<), expecting a MSGLEN

[danielnelson]

The best workaround is to use rsyslog to convert to the RFC5424 format. If you are feeling adventurous you should be able to send RFC3164 directly to the socket_listener and parse with data_format = "grok" as well.

[sjwang90]

@leodido Now that we have BSD syslog message support via #8454 is there anything else you're looking for in this issue?

[leodido]

Nope :)

Ty!