Skip to content

in_syslog: add unmatched_reason to emitted unmatched lines - #5570

Open
ynpreet wants to merge 3 commits into
fluent:masterfrom
ynpreet:in-syslog-unmatched-reason-3501
Open

ynpreet wants to merge 3 commits into
fluent:masterfrom
ynpreet:in-syslog-unmatched-reason-3501

Conversation

@ynpreet

@ynpreet ynpreet commented Oct 22, 2026

Copy link
Copy Markdown

Fixes #3501

When emit_unmatched_lines is enabled, in_syslog emits unmatched
lines as {"unmatched_line": "<line>"} (plus source keys), but gives
the receiver no indication of why the line was unmatched. The cause
only exists in the Fluentd log (invalid syslog message /
failed to parse message / invalid input), which the downstream
pipeline cannot see.

This change threads a reason through emit_unmatched so the emitted
record carries it:

  • PRI regex miss → unmatched_reason: "invalid syslog message"
  • Parser parse failure → unmatched_reason: "failed to parse message"
  • Exception in the handler → unmatched_reason: "invalid input (<Class>: <message>)"

The new argument is optional (reason = nil), so existing callers and
the record shape without a reason are unchanged, the emitted tag
(${tag}.unmatched) is unchanged, and the existing log lines are
unchanged.

Tests

  • Extended the existing unmatched-line test expectations in
    test/plugin/test_in_syslog.rb to assert unmatched_reason for the
    parser-failure path, and added two new tests: one for the
    invalid-syslog path (with_priority false, '...' PRI miss) and
    one for the exception path (unparseable timestamp raising
    TimeParseError).
  • Test result, verified Oct 21, 2026 in a fresh master clone:
    bundle exec ruby -Itest test/plugin/test_in_syslog.rb
    => 51 tests, 311 assertions, 0 failures, 0 errors, 100% passed.
    (Ruby 3.2.3 locally; the gemspec version floor was relaxed in the
    local clone ONLY for testing and is NOT part of this PR.)

Signed-off-by: Preet Mehta <preetmehta1995@gmail.com>
Signed-off-by: Preet Mehta <preetmehta1995@gmail.com>
Signed-off-by: Preet Mehta <preetmehta1995@gmail.com>
@Watson1978

Copy link
Copy Markdown
Contributor

@ynpreet Could you update the description to follow our PR template?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

emit warning along with unmatched line

2 participants