Syslog message with severity "warning" are considered as bad chunk by fluentd and discarded

[chaitrahegde115]

syslog_protocol gem is a dependency of fluentd-plugin-remote_syslog which is used to output logs to remote syslog. The logs which are created with severity "warning" are discarded by fluentd as bad chunk with the below message:

2020-02-05 15:18:38 +0530 [warn]: #0 got unrecoverable error in primary and no secondary error_class=ArgumentError error="'warning' is not a designated severity" 2020-02-05 15:18:38 +0530 [warn]: #0 suppressed same stacktrace 2020-02-05 15:18:38 +0530 [warn]: #0 bad chunk is moved to /tmp/fluent/backup/worker0/object_3fe96317eb5c/59dd0f8011f1edd9afad11041ad628f3.log

"warning" is a valid severity for syslog https://en.wikipedia.org/wiki/Syslog#Severity_level The source code of syslog_protocol still uses "warn" which is deprecated. Can you please suggest us the way forward to this?

Thanks

[daipom]

I can reproduce this problem.

  <source>
    @type sample
    tag "test"
    sample {"message":"Hello world."}
    rate 1
  </source>
  <match test.**>
    @type remote_syslog
    host "localhost"
    port 22222
    severity "warning"
    <buffer>
      flush_mode immediate
    </buffer>
  </match>
  <source>
    @type syslog
    tag "receive"
    port 22222
    bind "localhost"
  </source>
  <match receive.**>
    @type stdout
  </match>

[daipom]

The source code of syslog_protocol still uses "warn" which is deprecated.

As @chaitrahegde115 says, the syslog_protocol code is deprecated:

• https://github.com/eric/syslog_protocol/blob/v0.9.2/lib/syslog_protocol/common.rb#L58-L67

There is already a PR to fix this: https://github.com/eric/syslog_protocol/pull/9

However, the library seems to be not maintained for a while.

[daipom]

This problem is fixed. Thanks for reporting!