The trailer attribute in Syslog output plugin can not separate the metrics properly

Telegraf
1

I use syslog output plugin to transport my log file to a syslog collector like logstash. My config is as below
[[outputs.syslog]]
address = “tcp://…”
framing = “non-transparent”
trailer = “LF”

However I found that the separator character between different metrics is \x00 instead of \x0A.
And if I change the trailer attribute to “NUL”, then the separator is changed to \x01.
I use Telegraf 1.17 and 1.21 in Redhat7 platform, both have such problem. I am not sure that is a bug, or there is something wrong in my config. Please advise.

2

Hello @danny_yuan,
I’m not quite sure. Let me share your questions with experts. Thank you!

3

@danny_yuan can you provide an example log message where you are seeing this behavior?

As you said, I would have expected the non-transparent + LF option to use \x0A, which is the \n line feed charachter.

4

@jpowers my test is very simple, just using a shell script to generate a text file as below：

#!/bin/sh
echo "hello 123" >test.log
echo "hello 456" >>test.log
echo "hello 789" >>test.log
....

And using a inputs.tail plugin to capture the test.log. After startup telegraf, I run above shell script, then at log receiver side (I use logstash) I observe the abnormal output.
The most strange to me is that, the “NUL” will let the separator become \x01. Sounds a bug was hit.

5

Thanks for that! Congrats you found a bug :slight_smile:

We are using this go-syslog library to generate the strings. However, in Telegraf we are not using the Value() function to get the actual value of the trailer itself. Instead, we are using the const value.

I put up a PR here. Once tests pass, there will be some artifacts uploaded to the PR that you can download. Can you please give that a try?

Thanks!