feat(new sink): add dedicated syslog sink for RFC 5424/3164 output

[tot19]

Summary

Adds a new syslog sink that sends log events in syslog format (RFC 5424 or RFC 3164) over TCP, UDP, TCP with TLS, or Unix stream sockets.

This wraps Vector's existing socket transport utilities (TcpSinkConfig, UdpSinkConfig, UnixSinkConfig) with the syslog serializer from #23777/#24662. Syslog-specific options (rfc, facility, severity, app_name, proc_id, msg_id) are exposed under syslog for a first-class configuration experience. Addresses are parsed during config validation via ValidatedSink.

The sink supports stream framing for TCP and Unix stream transports:

• newline_delimited for RFC 6587 non-transparent framing.
• octet_counting for RFC 6587 octet-counting framing.
• TCP + TLS + RFC 5424 + octet_counting for RFC 5425 syslog over TLS.

This also hardens the syslog serializer for enterprise interoperability:

• Sanitizes RFC 5424 header fields and uses NILVALUE for empty invalid header fields.
• Normalizes structured-data names and avoids invalid empty SD names.
• Accepts common facility/severity aliases and numeric strings used by rsyslog/syslog-ng/syslog decoders.
• Rejects non-log events defensively instead of emitting an empty octet-counted frame.

Thanks to @vparfonov, @polarathene, and @syedriko for the syslog encoder work in #23777 that made this possible.

Vector configuration

TCP (RFC 5424):

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: tcp
    address: syslog.example.com:514
    syslog:
      rfc: rfc5424
      app_name: .app_name
      facility: .facility
      severity: .severity

UDP (RFC 3164):

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: udp
    address: syslog.example.com:514
    syslog:
      rfc: rfc3164

TCP with TLS (RFC 5425):

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: tcp
    address: syslog.example.com:6514
    tls:
      enabled: true
      ca_file: /path/to/ca.pem
    framing:
      method: octet_counting
    syslog:
      rfc: rfc5424

Unix stream socket:

sinks:
  my_syslog:
    type: syslog
    inputs:
      - my_source
    mode: unix_stream
    path: /path/to/syslog.sock

How did you test this PR?

Unit tests cover all transport modes, both RFC formats, custom PRI fields, TCP/TLS octet-counting, UDP datagram behavior, Unix stream delivery, reconnects, finalizer acknowledgement, address validation, and component compliance.

Codec tests cover RFC 5424/3164 formatting, PRI alias parsing (including the panic alias from master), numeric PRI parsing, RFC 5424 header field sanitization, structured-data escaping, structured-data name truncation, empty-name handling, and non-log event rejection.

Integration tests send to real rsyslog and syslog-ng receivers over UDP, TCP (newline and octet-counted framing), and TCP+TLS (RFC 5425). The receivers log the fields they parsed (facility, severity, hostname, app-name, procid, msgid, structured data, and MSG) as JSON, and the tests assert exact values, so a receiver misparsing any header field fails the test.

Validation commands run:

• cargo test -p codecs --features syslog --lib encoding::format::syslog
• cargo test --no-default-features --features sinks-syslog -p vector --lib sinks::syslog
• cargo vdev int test syslog
• cargo vdev check rust (full-feature Clippy, as run by make check-clippy)
• cargo fmt --all -- --check
• cargo vdev check markdown
• cargo vdev build component-docs (from a full-feature schema) + cargo vdev check generated-docs
• cargo vdev check component-examples
• cargo vdev check changelog-fragments
• ./scripts/cue.sh vet

Change Type

• New feature
• Bug fix
• Dependencies
• Non-functional (chore, refactoring, docs)
• Performance

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. Changelog fragment added.
• No.

References

• Closes: New syslog sink #6863
• Related: feat(codecs): Add syslog encoder #23777 (syslog encoder codec)
• Related: enhancement(codecs): advanced syslog Structured Data & RFC compliance fixes #24662 (syslog encoder follow-up)

Notes

• Encoding is fixed to syslog. Users who need configurable encoding, field filtering, or timestamp formatting can use the socket sink with encoding.codec = "syslog".
• Newline-delimited stream framing can split multiline messages. Use framing.method = "octet_counting" when messages can contain embedded newlines, such as stack traces or multiline JSON.
• RFC 5425 requires octet-counting. For syslog over TLS compliance, use TCP, TLS, RFC 5424, and framing.method = "octet_counting".
• RFC 3164 timestamps are emitted in UTC. This is documented rather than changed to local time for the initial sink to avoid host-local timezone ambiguity.
• Unix socket support is stream-only. Unix datagram sockets, including typical Linux /dev/log sockets, are not supported by this sink. Use the socket sink with mode = "unix_datagram" for that case.
• Message length policy is intentionally out of scope for v1. The sink currently sends the serialized event as produced by the codec and transport. A future max_message_length policy should define truncate/drop behavior, internal events/metrics, and transport-specific guidance.

Intentionally out of scope for this initial implementation

Please do not block this PR on these items unless maintainers want to expand scope:

• No max-message-length truncate/drop policy yet.
• No Unix datagram (/dev/log) mode in this dedicated sink.
• No RELP, batching, compression, disk-spool-specific semantics, or syslog aggregator behavior.
• No RFC 5424 UTF-8 BOM toggle.
• No promotion of octet-counting into the shared codec framing layer.
• No TLS hostname-verification integration test beyond the existing Vector TLS plumbing and the RFC5425 wire-format test.

[tot19]

@pront FYI, this should be ready for maintainer review now.

Main scope:

• Dedicated syslog sink for RFC 5424/3164 over TCP, UDP, TLS, and Unix stream.
• RFC 6587 newline and octet-counting stream framing.
• RFC 5425-compliant path via TCP + TLS + RFC5424 + octet-counting.
• Serializer hardening for RFC header fields, structured-data names, and syslog facility/severity aliases.

[tot19]

Added the following tests:

Unit tests (src/sinks/syslog.rs):

• tcp_finalizers_delivered_on_success — verifies BatchNotifier finalizers are marked Delivered after a successful TCP send.
• udp_finalizers_delivered_on_success — same for the UDP datagram path.
• tcp_reconnect_after_server_close — forces a hard TCP disconnect mid-stream and confirms the sink reconnects to a freshly bound listener.

Integration tests (src/sinks/syslog/integration_tests.rs):

• tcp_octet_counting_rfc5424_with_proc_id_msg_id_structured_data_reaches_rsyslog — routes proc_id, msg_id, and a structured_data ObjectMap through the config layer to a real rsyslog and verifies the SD-element survives encoding intact.
• tcp_tls_octet_counting_rfc5424_to_syslog_ng — RFC 5425 (syslog over TLS) interop against syslog-ng's TLS network transport with octet-counted framing.
• udp_rfc5424_reaches_syslog_ng — cross-daemon UDP coverage.
• tcp_octet_counting_rfc5424_reaches_syslog_ng — cross-daemon TCP octet-counted coverage.

A new balabit/syslog-ng:4.8.3 service was added to the integration compose file (rsyslog's 2026-02 image only ships plaintext TCP, hence syslog-ng for TLS). All 13 unit + 10 integration tests pass.

[tot19]

(disregard — accidental test post)

[tot19]

Adding per-change rationale on why the syslog codec was modified rather than left alone. The integration tests in this PR exercise the codec through real rsyslog and syslog-ng for the first time, which surfaced these issues — each section below cites the RFC paragraph or upstream behavior that motivated the change.

(GitHub's inline-review API is currently returning a 422 pull_request_review_thread.base error on this PR, possibly because it's behind master, so consolidating into one comment with clickable line links.)

Edited 2026-06-11: refreshed line links after rebasing onto current master, and updated the sections marked ⟳ to match the latest revision.

---

syslog.rs#L86-L88 — non-log event rejection

Previously the if let Event::Log(...) guard returned Ok(()) with an empty buffer if a metric or trace ever reached the encoder. With octet-counting framing (RFC 6587) that puts a zero-length frame on the wire; with newline framing it's a bare delimiter. Both are malformed. Returning an error lets the sink emit a proper events_dropped. Locked in by test_non_log_event_rejected.

---

syslog.rs#L140-L141 — hostname sanitization (both RFCs)

Hostname was previously a raw passthrough. A bare CR/LF or NUL terminated the message early at the receiver. Sanitized to printable ASCII for both RFCs now. Test: test_rfc3164_hostname_sanitization.

---

⟳ syslog.rs#L122-L131 + encode_rfc_3164 — RFC 3164 TAG hardening

RFC 3164 §4.1.3's TAG ends at the first non-alphanumeric character — in practice rsyslog and syslog-ng terminate the programname at the first space — so app_name/proc_id now go through the same PRINTUSASCII sanitizer as the RFC 5424 header fields (spaces become _). RFC 3164 has no NILVALUE, so an app_name that is empty after sanitization falls back to vector rather than emitting a bare : tag. The 32-char TAG truncation now truncates the app_name while keeping [proc_id]: intact, or drops the proc_id entirely when it can't fit — never an unbalanced app[123:. An empty MSG no longer leaves a trailing space after the tag. Tests: test_rfc3164_tag_space_sanitization, test_rfc3164_empty_app_name_falls_back_to_default, test_rfc3164_tag_truncation, test_rfc3164_tag_oversized_proc_id_dropped, test_rfc3164_empty_message_no_trailing_space.

---

syslog.rs#L132-L138 — RFC 5424 PRINTUSASCII + NILVALUE

RFC 5424 §6 defines HOSTNAME / APP-NAME / PROCID / MSGID as 1*nPRINTUSASCII (%d33-126). The previous code only truncated, so a hostname containing a space, tab, newline, or non-ASCII char (emojis from a buggy upstream are not hypothetical) emitted an unparseable frame — rsyslog drops it, syslog-ng tags it omitted_invalid_chars. Sanitization happens before length truncation. Empty post-sanitize values collapse to NILVALUE (-) per the same section, otherwise the frame would be <14>1 ... host - (double space) which fails the ABNF in both daemons. Tests: test_rfc5424_header_field_sanitization, test_rfc5424_empty_header_fields_use_nilvalue.

---

syslog.rs#L209-L216 — MAX_LENGTH constants

RFC 5424 §6 ABNF length bounds: HOSTNAME = 1*255PRINTUSASCII, APP-NAME = 1*48PRINTUSASCII, PROCID = 1*128PRINTUSASCII, MSGID = 1*32PRINTUSASCII, and SD-NAME = 1*32PRINTUSASCII (§6.3.3).

---

syslog.rs#L374-L424 — parse_facility / parse_severity alias tables

The most consequential codec change. The previous code used strum(serialize_all = "kebab-case"), so it only accepted the full Rust variant names: emergency, critical, error, warning, informational, security (13), console (14), solaris-cron (15). Vector's syslog source is built on syslog_loose, which emits emerg, crit, err, warning, info for severities and audit, alert, clockd for facilities 13/14/15. Result: syslog source → vrl → syslog encoder silently rewrote PRI to <14> (the User/Informational default) for those values — real data loss on the most common syslog topology in Vector. The aliases here cover both the syslog_loose names and common rsyslog/syslog-ng forms (kernel, auth-priv, log-alert). Numeric strings (Value::Bytes("3")) are also accepted via parse_numeric_code since many sources/transforms preserve numbers as strings. Test: test_pri_aliases_from_syslog_decoder_names.

---

⟳ syslog.rs#L699 — Facility::LogAlert = 14

RFC 5424 §6.2.1 Table 4 calls facility 14 "log alert". The previous name Console is a Solaris/BSD-ism not in the spec — and notably not what syslog_loose emits for that facility. console is kept as an alias in parse_facility for backward compatibility, alongside alert and log-alert. The latest revision also drops the now-unused EnumString/VariantNames derives and strum alias attributes from Facility/Severity — the removed get_syslog_code was their last FromStr caller, so the parse_facility/parse_severity tables are the single source of truth instead of two alias lists that could drift.

---

syslog.rs#L587-L614 — structured-data validity & collision handling

Two RFC 5424 §6.3.3 compliance gaps surfaced by the integration tests:

1. Empty SD-IDs were not skipped. SD-NAME is defined as 1*32PRINTUSASCII — at least one graphic ASCII char. Previously a {"": {...}} entry produced [ key="value"] (leading space, no name) — unparseable.
2. Post-truncation collisions silently overwrote. Two distinct keys longer than 32 chars that differed only past char 32 collapsed to the same BTreeMap key, dropping the second. deduped_key suffixes _1, _2, ... within the 32-char budget.

Tests: test_structured_data_empty_names_are_skipped, test_structured_data_param_name_length_limit_and_collision.

---

⟳ syslog.rs#L619 + join_sd_name#L318-L333 — flatten_object 32-char joined names

flatten_object joins sanitized segments with ., so a.b.c.d.e... can exceed the 32-char SD-NAME bound even when each segment is under it; previously the joined name went into the map as-is. The latest revision bounds the joined name via join_sd_name, which truncates the prefix and preserves the leaf segment — so sibling keys under a long path (…long-prefix….x vs …long-prefix….y) stay distinguishable instead of head-truncating to identical names; any remaining collisions still dedup with _N. Tests: test_structured_data_long_prefix_preserves_leaf_names, test_structured_data_prefix_truncation_collision_deduped.

[tot19]

@pront Possible to get a review on this in the near future or allow full test-suite run? Thanks!

[pront]

@pront Possible to get a review on this in the near future or allow full test-suite run? Thanks!

@tot19 done ~ apologies for the slow response

[tot19]

@pront fixed failing tests