codecs/
gelf.rs

1//! Contains common definitions for GELF codec support
2
3use std::sync::LazyLock;
4
5use regex::Regex;
6use vrl::{owned_value_path, path::OwnedTargetPath};
7
8/// GELF Message fields. Definitions from <https://docs.graylog.org/docs/gelf>.
9pub mod gelf_fields {
10    /// (not a field) The latest version of the GELF specification.
11    pub const GELF_VERSION: &str = "1.1";
12
13    /// (required) GELF spec version
14    pub const VERSION: &str = "version";
15
16    /// (required) The name of the host, source or application that sent this message.
17    pub const HOST: &str = "host";
18
19    /// (required) A short descriptive message.
20    pub const SHORT_MESSAGE: &str = "short_message";
21
22    /// (optional) A long message that can i.e. contain a backtrace
23    pub const FULL_MESSAGE: &str = "full_message";
24
25    /// (optional) Seconds since UNIX epoch with optional decimal places for milliseconds.
26    ///  SHOULD be set by client library. Will be set to the current timestamp (now) by the server if absent.
27    pub const TIMESTAMP: &str = "timestamp";
28
29    /// (optional) The level equal to the standard syslog levels. default is 1 (ALERT).
30    pub const LEVEL: &str = "level";
31
32    /// (optional) (deprecated) Send as additional field instead.
33    pub const FACILITY: &str = "facility";
34
35    /// (optional) (deprecated) The line in a file that caused the error (decimal). Send as additional field instead.
36    pub const LINE: &str = "line";
37
38    /// (optional) (deprecated) The file (with path if you want) that caused the error. Send as additional field instead.
39    pub const FILE: &str = "file";
40
41    // < Every field with an underscore (_) prefix will be treated as an additional field. >
42}
43
44/// GELF owned target paths.
45pub(crate) struct GelfTargetPaths {
46    pub version: OwnedTargetPath,
47    pub host: OwnedTargetPath,
48    pub full_message: OwnedTargetPath,
49    pub level: OwnedTargetPath,
50    pub facility: OwnedTargetPath,
51    pub line: OwnedTargetPath,
52    pub file: OwnedTargetPath,
53    pub short_message: OwnedTargetPath,
54}
55
56/// Lazily initialized singleton.
57pub(crate) static GELF_TARGET_PATHS: LazyLock<GelfTargetPaths> =
58    LazyLock::new(|| GelfTargetPaths {
59        version: OwnedTargetPath::event(owned_value_path!(gelf_fields::VERSION)),
60        host: OwnedTargetPath::event(owned_value_path!(gelf_fields::HOST)),
61        full_message: OwnedTargetPath::event(owned_value_path!(gelf_fields::FULL_MESSAGE)),
62        level: OwnedTargetPath::event(owned_value_path!(gelf_fields::LEVEL)),
63        facility: OwnedTargetPath::event(owned_value_path!(gelf_fields::FACILITY)),
64        line: OwnedTargetPath::event(owned_value_path!(gelf_fields::LINE)),
65        file: OwnedTargetPath::event(owned_value_path!(gelf_fields::FILE)),
66        short_message: OwnedTargetPath::event(owned_value_path!(gelf_fields::SHORT_MESSAGE)),
67    });
68
69/// Regex for matching valid field names in the encoder. According to the original spec by graylog,
70/// must contain only word chars, periods and dashes. Additional field names must also be prefixed
71/// with an `_` , however that is intentionally omitted from this regex to be checked separately
72/// to create a specific error message.
73/// As Graylog itself will produce GELF with any existing field names on the Graylog GELF Output,
74/// vector is more lenient, too, at least allowing the additional `@` character.
75pub static VALID_FIELD_REGEX: LazyLock<Regex> =
76    LazyLock::new(|| Regex::new(r"^[\w\.\-@]*$").unwrap());
codecs/gelf.rs

codecs/
gelf.rs
