mirror of
https://github.com/rsyslog/rsyslog.git
synced 2026-06-19 16:22:57 +02:00
d46cb261a6
Why: Elastic Agent and Beats can send events through the Logstash output using the Lumberjack protocol. rsyslog needs a native input for this protocol so these agents can feed existing rsyslog processing and forwarding pipelines directly. Impact: Adds the optional imbeats input module, documentation, tests, and a sample container for receiving Beats data over plain TCP or TLS. Before/After: Before, rsyslog had no native Beats/Lumberjack input. After, imbeats can accept Lumberjack v2 JSON events, preserve the original payload, expose parsed fields under $!, and acknowledge received batches. Technical Overview: The new imbeats module uses rsyslog netstream listeners to accept Lumberjack v2 window, JSON, compressed, and ACK flows. It decodes event JSON into message properties, stores receiver metadata under $!metadata!imbeats, and provides bounds for window size, frame size, and decompressed payload size. The module supports TLS through the existing stream driver configuration surface. The change wires imbeats into configure and Automake, adds RainerScript and YAML tests, documents module and parameter usage, adds an imbeats CI job, and provides a sample user-facing container definition without adding it to the release container build flow. With the help of AI-Agents: Codex