How to receive Syslog using socket_server?

[webfrank]

Hi,
I was trying to use Benthos to receive and process syslog messages. I stopped on the codec of the socker_server input. If I use all-bytes no message is received (probably buffered in memory). Lines or delimiter it is not usable as messages are sent without any delimiter.
I think a "datagram" codec could be of help, sending out each received datagram.

Any suggestion?

[mihaitodor]

Hey @webfrank 👋

If I use all-bytes no message is received (probably buffered in memory). Lines or delimiter it is not usable as messages are sent without any delimiter.

It's a bit unclear what defines a message in this case. Would the chunker codec help? If the datagrams have fixed size, then you should be able to use that to receive each datagram. However, it sounds like the kind of use case where I'd consider writing a custom input plugin.

LE: Converting this issue to a discussion as mentioned in #2026.

[webfrank]

Hi,
for syslog a "message" is a single datagram, this is why I suggest to just implement the "datagram" codec, this way any single datagram received by the socket could be spitted out as single message.

[mihaitodor]

I haven't dug into the code, but the way the codecs are implemented now, they have no knowledge of how the data gets placed into the reader that they operate on. Instead of having a "datagram" codec, I think what might be possible is for the input to have a config flag which can be used to force it to emit a message per datagram. Dunno how much effort that would require to implement, though. The relevant code is here.