Add configuration option for RFC 5424 Structured Data

lib/logstash/outputs/syslog.rb

@@ -122,6 +122,15 @@ class LogStash::Outputs::Syslog < LogStash::Outputs::Base
   # to help you build a new value from other parts of the event.
   config :msgid, :validate => :string, :default => "-"
 
+  # structured data for syslog message for rfc 5424
+  # expects a fully formatted structured data string including brackets,
+  # element IDs, and key-value pairs
+  config :structured_data, :validate => :string, :default => "-"
+
+  # use frame header (message length) for rfc 5425
+  # this is required for rsyslog and syslog-ng to receive TCP syslog in TLS
+  config :frame_header, :validate => :boolean, :default => false
+
   # syslog message format: you can choose between rfc3164 or rfc5424
   config :rfc, :validate => ["rfc3164", "rfc5424"], :default => "rfc3164"
 
@@ -151,6 +160,7 @@ def publish(event, payload)
     appname = event.sprintf(@appname)
     procid = event.sprintf(@procid)
     sourcehost = event.sprintf(@sourcehost)
+    structured_data = event.sprintf(@structured_data)
 
     message = payload.to_s.rstrip.gsub(/[\r][\n]/, "\n").gsub(/[\n]/, '\n')
 
@@ -170,7 +180,11 @@ def publish(event, payload)
     else
       msgid = event.sprintf(@msgid)
       timestamp = event.sprintf("%{+YYYY-MM-dd'T'HH:mm:ss.SSSZZ}")
-      syslog_msg = "<#{priority.to_s}>1 #{timestamp} #{sourcehost} #{appname} #{procid} #{msgid} - #{message}"
+      syslog_msg = "<#{priority.to_s}>1 #{timestamp} #{sourcehost} #{appname} #{procid} #{msgid} #{structured_data} #{message}"
+      if @frame_header
+        msg_len = syslog_msg.length.to_s
+        syslog_msg = "#{msg_len} #{syslog_msg}"
+      end
     end
 
     begin

spec/outputs/syslog_spec.rb

@@ -46,6 +46,20 @@
     it_behaves_like "syslog output"
   end
 
+  context "rfc 5424 with structured data" do
+    let(:options) { {"rfc" => "rfc5424", "structured_data" => '[[email protected] name="foo.log"]', "protocol" => "tcp", "host" => "foo", "port" => "123", "facility" => "kernel", "severity" => "emergency"} }
+    let(:output) { /^<0>1 #{RFC3339_DATE_TIME_REGEX} baz LOGSTASH - - \[[email protected] name=\"foo.log\"\] bar\n/m }
+
+    it_behaves_like "syslog output"
+  end
+
+  context "rfc 5425 and tcp (frame header)" do
+    let(:options) { {"rfc" => "rfc5424", "frame_header" => true, "protocol" => "tcp", "host" => "foo", "port" => "123", "facility" => "kernel", "severity" => "emergency"} }
+    let(:output) { /^\d+ <0>1 #{RFC3339_DATE_TIME_REGEX} baz LOGSTASH - - - bar\n/m }
+
+    it_behaves_like "syslog output"
+  end
+
   context "calculate priority" do
     let(:options) { {"host" => "foo", "port" => "123", "facility" => "mail", "severity" => "critical"} }
     let(:output) { /^<18>#{RFC3164_DATE_TIME_REGEX} baz LOGSTASH\[-\]: bar\n/m }