Transform RFC3164 message? (missing tag)

[etfz]

Question

Hi,

New to Vector. I understand it can do a lot of transformations. I'm currently dealing with a number of devices whose platform employs RFC3164 syslog messaging, but does not include a tag in the message part. This confuses syslog collectors. I would like to set up a dedicated endpoint for these devices, which transforms the messages like so:

-<34>Oct 11 22:14:15 mymachine 'su root' failed for lonvick on /dev/pts/8
+<34>Oct 11 22:14:15 mymachine MY_TAG: 'su root' failed for lonvick on /dev/pts/8

[etfz]

Had a go at it. This seems to do the trick:

sources:
  syslog:
    type: syslog
    mode: udp
    address: 0.0.0.0:515

transforms:
  remap_syslog:
    inputs: [syslog]
    type: remap
    source: |
      .message, err = .appname + " " + .message
      .appname = "MY_TAG"