feat(new sink): add dedicated syslog sink for RFC 5424/3164 output

.github/workflows/changes.yml

@@ -144,6 +144,8 @@ on:
         value: ${{ jobs.int_tests.outputs.redis }}
       splunk:
         value: ${{ jobs.int_tests.outputs.splunk }}
+      syslog:
+        value: ${{ jobs.int_tests.outputs.syslog }}
       webhdfs:
         value: ${{ jobs.int_tests.outputs.webhdfs }}
       # e2e tests
@@ -404,6 +406,7 @@ jobs:
       pulsar: ${{ steps.filter.outputs.pulsar }}
       redis: ${{ steps.filter.outputs.redis }}
       splunk: ${{ steps.filter.outputs.splunk }}
+      syslog: ${{ steps.filter.outputs.syslog }}
       webhdfs: ${{ steps.filter.outputs.webhdfs }}
       any: ${{ steps.detect-changes.outputs.any }}
     steps:
@@ -470,6 +473,7 @@ jobs:
             "pulsar": ${{ steps.filter.outputs.pulsar }},
             "redis": ${{ steps.filter.outputs.redis }},
             "splunk": ${{ steps.filter.outputs.splunk }},
+            "syslog": ${{ steps.filter.outputs.syslog }},
             "webhdfs": ${{ steps.filter.outputs.webhdfs }}
           }
           EOF

.github/workflows/ci-integration-review.yml

@@ -141,6 +141,7 @@ jobs:
             "pulsar",
             "redis",
             "splunk",
+            "syslog",
             "webhdfs"
           ]
     steps:

.github/workflows/integration.yml

@@ -133,6 +133,7 @@ jobs:
             "pulsar",
             "redis",
             "splunk",
+            "syslog",
             "webhdfs"
           ]
     timeout-minutes: 90

Cargo.toml

@@ -938,6 +938,7 @@ sinks-logs = [
   "sinks-sematext",
   "sinks-socket",
   "sinks-splunk_hec",
+  "sinks-syslog",
   "sinks-vector",
   "sinks-webhdfs",
   "sinks-websocket",
@@ -1011,6 +1012,7 @@ sinks-sematext = ["sinks-elasticsearch", "sinks-influxdb"]
 sinks-socket = ["sinks-utils-udp"]
 sinks-splunk_hec = []
 sinks-statsd = ["sinks-utils-udp", "tokio-util/net"]
+sinks-syslog = ["codecs-syslog", "sinks-utils-udp"]
 sinks-utils-udp = []
 sinks-vector = ["sinks-utils-udp", "dep:tonic", "protobuf-build", "dep:prost"]
 sinks-websocket = ["dep:tokio-tungstenite"]
@@ -1060,6 +1062,7 @@ all-integration-tests = [
   "pulsar-integration-tests",
   "redis-integration-tests",
   "splunk-integration-tests",
+  "syslog-integration-tests",
   "vector-api-tests",
   "webhdfs-integration-tests",
   "windows-event-log-integration-tests",
@@ -1129,6 +1132,7 @@ prometheus-integration-tests = ["sinks-prometheus", "sources-prometheus", "sinks
 pulsar-integration-tests = ["sinks-pulsar", "sources-pulsar"]
 redis-integration-tests = ["sinks-redis", "sources-redis"]
 splunk-integration-tests = ["sinks-splunk_hec"]
+syslog-integration-tests = ["sinks-syslog"]
 dnstap-integration-tests = ["sources-dnstap", "dep:bollard"]
 webhdfs-integration-tests = ["sinks-webhdfs"]
 windows-event-log-integration-tests = ["sources-windows_event_log-integration-tests"]

changelog.d/6863_syslog_sink.feature.md

@@ -0,0 +1,6 @@
+Added a new `syslog` sink for sending log events in syslog format (RFC 5424 or RFC 3164) over TCP,
+UDP, or Unix stream sockets, with configurable stream framing, TLS support, configurable facility,
+severity, app_name, proc_id, and msg_id field mappings, and improved syslog encoder compatibility
+for header fields, structured-data names, and common facility/severity aliases.
+
+authors: tot19

lib/codecs/src/encoding/format/mod.rs

@@ -48,7 +48,7 @@ pub use otlp::{OtlpSerializer, OtlpSerializerConfig};
 pub use protobuf::{ProtobufSerializer, ProtobufSerializerConfig, ProtobufSerializerOptions};
 pub use raw_message::{RawMessageSerializer, RawMessageSerializerConfig};
 #[cfg(feature = "syslog")]
-pub use syslog::{SyslogSerializer, SyslogSerializerConfig};
+pub use syslog::{SyslogSerializer, SyslogSerializerConfig, SyslogSerializerOptions};
 pub use text::{TextSerializer, TextSerializerConfig};
 use vector_core::event::Event;