[jira] [Commented] (FLUME-2217) Preserve priority, timestamp and hostname fields in MultiportSyslogTcp and Udp sources

["Xuri Nagarin (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FLUME-2217?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14066642#comment-14066642 ] 

Xuri Nagarin commented on FLUME-2217:
-------------------------------------

Including the PRI part in the message is unusual to say the least. None of the other major syslog processors (syslog-ng and rsyslog), by default, write out the PRI part. I think first you need to figure out what RFC are you looking to comply with? If it is 3164, which is still the most used, then you need to set separate flags for PRI and HEADER because as per 3164:
"The full format of a syslog message seen on the wire has three discernable parts.  The first part is called the PRI, the second part is the HEADER, and the third part is the MSG."

"keepFields" clubs the PRI and HEADER into one field. Instead, you should use "keepPri" and "keepHeader". 

> Preserve priority, timestamp and hostname fields in MultiportSyslogTcp and Udp sources
> --------------------------------------------------------------------------------------
>
>                 Key: FLUME-2217
>                 URL: https://issues.apache.org/jira/browse/FLUME-2217
>             Project: Flume
>          Issue Type: Improvement
>          Components: Sinks+Sources
>    Affects Versions: v1.5.0
>            Reporter: Jeff Lord
>            Assignee: Jeff Lord
>             Fix For: v1.5.0
>
>         Attachments: FLUME-2217.1.patch, FLUME-2217.2.patch, FLUME-2217.3.patch, FLUME-2217.6.patch
>
>
> Flume-1666 added the ability to preserve timestamp and hostname fields of a syslog message. We should also add this property to the MultiportSyslogTcp Source and the SyslogUdp sources.



--
This message was sent by Atlassian JIRA
(v6.2#6252)