VRL Support on Syslog Ingestion
TLDR Dustin asked if he was doing something wrong in a VRL script. Ashish clarified that VRL functions are not supported on syslog ingestion, but are supported on all other ingestion endpoints.
Hengfei
Thu, 15 Jun 2023 15:10:14 UTCAshish i remember we don't support vrl function for syslog ingestion?
Ashish
Thu, 15 Jun 2023 15:16:49 UTCWe don't support vrl functions on syslog
Dustin
Thu, 15 Jun 2023 15:18:18 UTCGotcha, Is there a list of ingestions that support VRL?
Ashish
Thu, 15 Jun 2023 15:20:10 UTCExcept for traces & syslog
Ashish
Thu, 15 Jun 2023 15:20:32 UTCWe support functions on all other ingestion end points
OpenObserve
Indexed 419 threads
OpenObserve is an open-source, petabyte-scale observability platform for the cloud native realm, offering a 10x cost reduction and 140x less storage use compared to competitors like Elasticsearch or Splunk. Built in Rust for exceptional performance, it offers comprehensive features like logs, metrics, traces, dashboards, and more | Knowledge Base powered by Struct.AI
View in App
Dustin
Thu, 15 Jun 2023 15:07:49 UTCExample Log event coming in via Syslog ```{ "_timestamp": 1686841590000000, "appname": "filterlog", "facility": "local0", "hostname": "",
"message": "13,,,02f4bab031b57d1e30553ce08e0ec131,vlan01,match,block,in,4,0x0,,64,35751,0,DF,17,udp,32,10.0.1.1,255.255.255.255,53299,10001,12",
"meta_sequenceid": "637776",
"procid": 94059,
"severity": "info",
"version": 1
}```
VRL Script only working during query not during ingestion
```if .appname == "filterlog" {
ts = ._timestamp # store value of _timestamp in ts
test = parse_csv!(.message)
.rulenr = test[0]
.subrulenr = test[1]
.anchorname = test[2]
.label = test[3]
.interface = test[4]
.reason = test[5]
.action = test[6]
.dir = test[7]
.ipversion = test[8]
.tos = test[9]
.ecn = test[10]
.ttl = test[11]
.id = test[12]
.offset = test[13]
.flags = test[14]
.protonum = test[15]
.protoname = test[16]
.length = test[17]
.src = test[18]
.dest = test[19]
._timestamp = ts #set value of _timestamp from ts
. # return record
}```
Can you please assist if I am doing something wrong?