Sending a RFC5424 syslog message to promtail that contains an OID as a field key:
This fails:
<13>1 2021-03-17T18:46:32.597065-04:00 Test - - - [NXLOG@14506 MessageSourceAddress=“10.10.10.9” CISCO-SMI::ciscoMgmt.43.1.1.6.1.3.16015=“1”] Test
This fails:
<13>1 2021-03-17T18:46:32.597065-04:00 Test - - - [NXLOG@14506 MessageSourceAddress=“10.10.10.9” 1.3.6.1.4.1.9.9.43.1.1.6.1.5.1970=“1”] Test
This is OK:
<13>1 2021-03-17T18:46:32.597065-04:00 Test - - - [NXLOG@14506 MessageSourceAddress=“10.10.10.9”] Test
Error message from promtail:
err="expecting a structured data parameter (key=\"value\", both part from 1 to max 32 US-ASCII characters; key cannot contain =, , ], and \", while value cannot contain ], backslash, and \" unless escaped) [col 117]
There is no mention of dots “.” in the the proscribed keys.
I am generating the messages from Nxlog with has a module to parse snmp traps and automatigicaly convert them to fields and can be send using syslogietf format with octet framing. Works perfectly except for the damn dots.
Tried with promtail 2.1 and 2.2