fix(syslog): skip empty KubernetesMinimal prefixes for non-container logs by vparfonov · Pull Request #3374 · openshift/cluster-logging-operator

vparfonov · 2026-07-24T18:33:44Z

Description

Links

Depending on PR(s):
Port-forward: [release-6.6]fix(syslog): skip empty KubernetesMinimal prefixes for non-container logs (LOG-9694) #3373
GitHub issue:
JIRA:
Enhancement proposal:

Summary by CodeRabbit

Bug Fixes
- Kubernetes-minimal syslog enrichment now omits empty namespace_name, container_name, and pod_name fields.
- Syslog .message formatting is cleaner when Kubernetes metadata is absent, avoiding unnecessary prefixes.
- Applies to both RFC3164 and RFC5424 outputs, including audit and infrastructure journal logs.
Tests
- Added functional coverage ensuring enriched syslog lines don’t contain empty Kubernetes fields and that no VRL compilation warnings appear.

…logs (LOG-9694) Syslog forwarding with KubernetesMinimal enrichment unconditionally added namespace_name=, container_name=, pod_name= prefixes even to audit and journald logs that have no Kubernetes metadata. Now these fields are only included when present and non-empty. Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

coderabbitai · 2026-07-24T18:34:14Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5c9d06a1-d556-4adf-b658-c2e4d017e0be

📥 Commits

Reviewing files that changed from the base of the PR and between cf1b47c and b2fbd9f.

📒 Files selected for processing (2)

internal/generator/vector/output/syslog/syslog.go
internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml

🚧 Files skipped from review as they are similar to previous changes (2)

internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml
internal/generator/vector/output/syslog/syslog.go

📝 Walkthrough

Walkthrough

Changes

Syslog enrichment behavior

Layer / File(s)	Summary
Conditional message assembly `internal/generator/vector/output/syslog/syslog.go`, `internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml`	Kubernetes metadata is included only when present and non-empty; messages without metadata retain the original message value.
RFC3164 and RFC5424 validation `test/functional/outputs/syslog/rfc3164_test.go`, `test/functional/outputs/syslog/rfc5424_test.go`	Functional tests cover audit and infrastructure inputs and verify that empty Kubernetes fields and VRL compilation warnings are absent.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: clee2691, cahartma

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description keeps the template headings and commands, but it lacks an actual problem/rationale summary and most link details.	Add a short narrative describing the issue, rationale, and implementation, and fill in the relevant links or mark them intentionally absent.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the PR's main syslog fix for skipping empty KubernetesMinimal prefixes on non-container logs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

qodo-for-rh-openshift · 2026-07-24T18:35:29Z

PR Summary by Qodo

Fix syslog KubernetesMinimal enrichment to skip empty prefixes on non-container logs

🐞 Bug fix 🧪 Tests 🕐 20-40 Minutes

AI Description

• Only prepend KubernetesMinimal fields when Kubernetes metadata exists and is non-empty.
• Keep audit and infrastructure journal syslog payloads clean when metadata is missing.
• Add functional coverage for RFC3164/RFC5424 outputs and ensure no VRL warnings.

Diagram

graph TD
  src["Audit/Journal logs"] --> vec["Vector pipeline"] --> vrl["KubernetesMinimal VRL"] --> sink["Syslog output"] --> recv["Syslog receiver"]
  tests["Functional tests"] --> vrl

High-Level Assessment

The following are alternative approaches to this PR:

1. Always format full prefix but post-trim empties

➕ Keeps the old output shape in one place (single format string).
➖ Requires fragile string manipulation/regex; higher risk of corner-case artifacts like extra commas/spaces.
➖ Harder to reason about when fields are absent vs empty.

2. Normalize kubernetes.* fields earlier in the pipeline

➕ Potentially benefits other outputs/transforms beyond syslog.
➖ Broader behavioral change across pipelines/outputs; higher regression risk.
➖ Still needs syslog-specific decisions about how to format the message.

Recommendation: The PR’s approach (build a parts list and join only non-empty fields) is the most robust and least invasive: it fixes formatting at the point where syslog payload is constructed, avoids brittle string trimming, and keeps behavior consistent for both RFC3164 and RFC5424 outputs.

Files changed (4) +158 / -14

Bug fix (2) +42 / -14

syslog.goConditionally build KubernetesMinimal syslog message prefixes +21/-7

Conditionally build KubernetesMinimal syslog message prefixes

• Updates the embedded VRL used for KubernetesMinimal enrichment to only include namespace/container/pod prefixes when the corresponding fields exist and are non-empty. Falls back to emitting the original message value when no Kubernetes metadata is present.

internal/generator/vector/output/syslog/syslog.go

tcp_with_kubernetes_minimal_enrichment.tomlAlign syslog enrichment TOML with conditional prefix behavior +21/-7

Align syslog enrichment TOML with conditional prefix behavior
• Mirrors the Go-generated VRL logic in the example/fixture TOML by building a parts array and joining only non-empty Kubernetes fields. Prevents empty 'namespace_name=', 'container_name=', and 'pod_name=' prefixes for non-container logs.
internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml

Tests (2) +116 / -0

rfc3164_test.goAdd RFC3164 functional tests for non-container logs with KubernetesMinimal +58/-0

Add RFC3164 functional tests for non-container logs with KubernetesMinimal
• Adds functional cases for audit and infrastructure journal inputs verifying syslog payloads do not contain empty KubernetesMinimal prefixes. Also asserts collector logs contain no VRL compilation warnings.
test/functional/outputs/syslog/rfc3164_test.go

rfc5424_test.goAdd RFC5424 functional tests for non-container logs with KubernetesMinimal +58/-0

Add RFC5424 functional tests for non-container logs with KubernetesMinimal
• Adds the same audit and infrastructure journal validation scenarios as RFC3164, ensuring RFC5424 syslog output remains free of empty KubernetesMinimal prefixes and produces no VRL compilation warnings.
test/functional/outputs/syslog/rfc5424_test.go

qodo-for-rh-openshift · 2026-07-24T18:38:27Z

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 9 rules

1. Audit logs omit kubernetes_metadata 📘 Rule violation ◔ Observability

Description

In KubernetesMinimal enrichment, when no Kubernetes fields are present the code sets `.message =
msg_value`, producing syslog payloads without any Kubernetes metadata placeholder. This conflicts
with the requirement that every processed log entry include kubernetes_metadata even when empty.

Code

internal/generator/vector/output/syslog/syslog.go[R181-186]

+if length(parts) > 0 {
+  parts = push(parts, "message=" + msg_value)
+  .message = join!(parts, ", ")
+} else {
+  .message = msg_value
+}`

Relevance

⭐⭐ Medium
Repo precedent favors omitting k8s fields on non-container logs; unclear they’ll add empty
kubernetes_metadata placeholder.
PR-#3297
PR-#3328

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
PR Compliance ID 208 requires every processed log entry to include kubernetes_metadata even if
empty. The updated KubernetesMinimal VRL sets .message = msg_value when no Kubernetes fields
exist, and the new functional tests explicitly validate that empty Kubernetes prefixes are not
present for audit/journal logs—confirming this output path omits any Kubernetes metadata
placeholder.
Rule 208: Include required attributes in every processed log entry
internal/generator/vector/output/syslog/syslog.go[163-186]
internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml[81-107]
test/functional/outputs/syslog/rfc3164_test.go[133-156]
test/functional/outputs/syslog/rfc5424_test.go[245-268]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
KubernetesMinimal enrichment currently drops Kubernetes metadata entirely for non-container logs (e.g., audit/journald) by setting `.message = msg_value` when no `parts` are present. Compliance requires every processed log entry to include `kubernetes_metadata` even if it is empty.

## Issue Context
The current implementation intentionally avoids emitting empty `namespace_name=`, `container_name=`, `pod_name=` prefixes, and functional tests assert those empty prefixes are absent. To satisfy the compliance requirement without reintroducing empty prefixes, emit an explicit placeholder (e.g., `kubernetes_metadata={}` or an equivalent agreed-upon serialization) when Kubernetes metadata is missing.

## Fix Focus Areas
- internal/generator/vector/output/syslog/syslog.go[163-186]
- internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml[81-107]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-for-rh-openshift · 2026-07-24T18:38:28Z

+if length(parts) > 0 {
+  parts = push(parts, "message=" + msg_value)
+  .message = join!(parts, ", ")
+} else {
+  .message = msg_value
+}`


1. Audit logs omit kubernetes_metadata 📘 Rule violation ◔ Observability

In KubernetesMinimal enrichment, when no Kubernetes fields are present the code sets `.message = msg_value`, producing syslog payloads without any Kubernetes metadata placeholder. This conflicts with the requirement that every processed log entry include kubernetes_metadata even when empty.

Agent Prompt

## Issue description KubernetesMinimal enrichment currently drops Kubernetes metadata entirely for non-container logs (e.g., audit/journald) by setting `.message = msg_value` when no `parts` are present. Compliance requires every processed log entry to include `kubernetes_metadata` even if it is empty. ## Issue Context The current implementation intentionally avoids emitting empty `namespace_name=`, `container_name=`, `pod_name=` prefixes, and functional tests assert those empty prefixes are absent. To satisfy the compliance requirement without reintroducing empty prefixes, emit an explicit placeholder (e.g., `kubernetes_metadata={}` or an equivalent agreed-upon serialization) when Kubernetes metadata is missing. ## Fix Focus Areas - internal/generator/vector/output/syslog/syslog.go[163-186] - internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml[81-107]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

…logs (LOG-9694) Syslog forwarding with KubernetesMinimal enrichment unconditionally added namespace_name=, container_name=, pod_name= prefixes even to audit and journald logs that have no Kubernetes metadata. Now these fields are only included when present and non-empty. Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

vparfonov · 2026-07-25T08:33:31Z

/retest-required

openshift-ci · 2026-07-25T10:41:00Z

@vparfonov: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-using-bundle	`b2fbd9f`	link	false	`/test e2e-using-bundle`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

jcantrill

/approve
/lgtm

openshift-ci · 2026-07-27T15:56:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill, vparfonov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot requested review from Clee2691 and cahartma July 24, 2026 18:34

qodo-for-rh-openshift Bot reviewed Jul 24, 2026

View reviewed changes

jcantrill added release/6.6 release/6.7 and removed release/6.6 labels Jul 27, 2026

jcantrill reviewed Jul 27, 2026

View reviewed changes

openshift-ci Bot assigned jcantrill Jul 27, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 27, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 27, 2026

openshift-merge-bot Bot merged commit d3b6f7a into openshift:master Jul 27, 2026
9 of 10 checks passed

vparfonov deleted the log9694-master branch July 27, 2026 21:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(syslog): skip empty KubernetesMinimal prefixes for non-container logs - #3374

fix(syslog): skip empty KubernetesMinimal prefixes for non-container logs#3374
openshift-merge-bot[bot] merged 2 commits into
openshift:masterfrom
vparfonov:log9694-master

vparfonov commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

qodo-for-rh-openshift Bot commented Jul 24, 2026

Uh oh!

qodo-for-rh-openshift Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

qodo-for-rh-openshift Bot Jul 24, 2026

Uh oh!

vparfonov commented Jul 25, 2026

Uh oh!

openshift-ci Bot commented Jul 25, 2026

Uh oh!

jcantrill left a comment

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

vparfonov commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Links

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

qodo-for-rh-openshift Bot commented Jul 24, 2026

PR Summary by Qodo

Uh oh!

qodo-for-rh-openshift Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-for-rh-openshift Bot Jul 24, 2026

Choose a reason for hiding this comment

Uh oh!

vparfonov commented Jul 25, 2026

Uh oh!

openshift-ci Bot commented Jul 25, 2026

Uh oh!

jcantrill left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vparfonov commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

qodo-for-rh-openshift Bot commented Jul 24, 2026 •

edited

Loading