fix(syslog): normalize syslog severity to lowercase in VRL validation

[vparfonov]

Description

The VRL to_syslog_severity() function is case-sensitive and only accepts lowercase keywords, causing spurious "Invalid syslog severity value" warnings when users configure capitalized severity keywords like "Informational" or "Critical".

Add downcase normalization before the to_syslog_severity() call so case-insensitive keywords are correctly validated without warnings.

/cc @Clee2691
/assign @jcantrill

Links

• Depending on PR(s):
• GitHub issue:
• JIRA: https://redhat.atlassian.net/browse/LOG-9609
• Enhancement proposal:

Summary by CodeRabbit

• Bug Fixes

  • Improved syslog severity processing by making severity-name inputs case-insensitive, ensuring mixed-case and capitalized spellings map to the correct severity for syslog outputs.
  • Improved consistency of syslog PRI/severity encoding across supported syslog output configurations (RFC3164/RFC5424).

• Tests

  • Added/extended functional coverage for RFC3164 severity keyword spellings, verifying correct <PRI> prefixes and asserting no “Invalid syslog severity” or VRL compilation warnings.
  • Expanded the RFC5424 PRI/severity table to include all supported textual variants (including capitalized forms) and validated the same warning-free behavior.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Syslog output generation now lowercases ._syslog.severity before severity conversion across generated templates and shared VRL logic. RFC3164 and RFC5424 functional tests now cover multiple severity keyword casings and verify PRI prefixes and collector warnings.

Changes

Syslog severity casing

Layer / File(s)	Summary
Normalize severity input internal/generator/vector/output/syslog/syslog.go, internal/generator/vector/output/syslog/rfc3164_with_defaults.toml, internal/generator/vector/output/syslog/tcp_with_defaults.toml, internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml, internal/generator/vector/output/syslog/tcp_with_tuning.toml, internal/generator/vector/output/syslog/tls_with_field_references.toml, internal/generator/vector/output/syslog/udp_with_every_setting.toml	Lowercases ._syslog.severity after converting it to a string before calling to_syslog_severity() in the generator output and syslog templates.
Verify severity casings test/functional/outputs/syslog/rfc3164_test.go, test/functional/outputs/syslog/rfc5424_test.go	Adds table-driven functional coverage for multiple severity keyword spellings, checks expected <PRI> prefixes, and asserts collector logs do not contain VRL compilation or invalid-severity warnings.

Estimated code review effort: 2 (Simple) | ~12 minutes

Suggested labels: lgtm

Suggested reviewers: jcantrill, Clee2691

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: lowercasing syslog severity before VRL validation.
Description check	✅ Passed	The description clearly explains the issue, rationale, implementation, required /cc and /assign commands, and includes a related JIRA link.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jcantrill]

/hold

[jcantrill]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jcantrill, vparfonov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

internal/generator/vector/output/syslog/syslog.go (1)

98-101: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Facility conversion has the same case-sensitivity gap but wasn't fixed.

The Facility field docs state values can be case-insensitive keywords (e.g. user, local0, etc.), same as Severity. The facility block directly above (Lines 79-96) still calls to_syslog_facility_code(._syslog.facility) without any downcase normalization, so capitalized facility keywords would still trip the same "Invalid syslog facility value" warning this PR is fixing for severity.

Consider applying the identical downcase(to_string!(...)) normalization to ._syslog.facility for consistency.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/generator/vector/output/syslog/syslog.go` around lines 98 - 101, The
syslog generator still has the same case-sensitivity bug for facility values
that was fixed for severity. Update the facility handling in the syslog
transform block around the existing to_syslog_facility_code(._syslog.facility)
call to normalize ._syslog.facility with downcase(to_string(...)) before
conversion, mirroring the severity logic in the same output generator so
capitalized keywords like local0 and user are accepted consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/generator/vector/output/syslog/syslog.go`:
- Around line 98-101: The syslog severity normalization in the
`._syslog.severity` handling block uses a fallible string conversion, which can
break the shared remap. Update the severity assignment in the syslog transform
to use `to_string!()` (or add equivalent explicit error handling) before
`downcase(...)`, since the value may come from `.level` and must not rely on an
infallible conversion.

In `@internal/generator/vector/output/syslog/tcp_with_tuning.toml`:
- Around line 50-53: The syslog severity normalization in the remap block uses a
fallible to_string() call, which can break VRL compilation before downcase()
runs. Update the logic in the severity handling path so the conversion is
handled explicitly, using to_string!(...) or a fallback with ?? before passing
the value to downcase(), and keep the change localized to the ._syslog.severity
normalization in the syslog TCP tuning generator.

---

Nitpick comments:
In `@internal/generator/vector/output/syslog/syslog.go`:
- Around line 98-101: The syslog generator still has the same case-sensitivity
bug for facility values that was fixed for severity. Update the facility
handling in the syslog transform block around the existing
to_syslog_facility_code(._syslog.facility) call to normalize ._syslog.facility
with downcase(to_string(...)) before conversion, mirroring the severity logic in
the same output generator so capitalized keywords like local0 and user are
accepted consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2a5375f6-9e3b-4110-9d13-19703ef1b743

📥 Commits

Reviewing files that changed from the base of the PR and between f32eb77 and 3477b86.

📒 Files selected for processing (9)

• internal/generator/vector/output/syslog/rfc3164_with_defaults.toml
• internal/generator/vector/output/syslog/syslog.go
• internal/generator/vector/output/syslog/tcp_with_defaults.toml
• internal/generator/vector/output/syslog/tcp_with_kubernetes_minimal_enrichment.toml
• internal/generator/vector/output/syslog/tcp_with_tuning.toml
• internal/generator/vector/output/syslog/tls_with_field_references.toml
• internal/generator/vector/output/syslog/udp_with_every_setting.toml
• test/functional/outputs/syslog/rfc3164_test.go
• test/functional/outputs/syslog/rfc5424_test.go

[vparfonov]

/retest-required

[vparfonov]

/retest-required

[vparfonov]

/retest-required

[vparfonov]

/retest-required

[Clee2691]

/lgtm
/retest

[vparfonov]

/test e2e-target

[vparfonov]

/test e2e-target

[jcantrill]

/lgtm

[jcantrill]

/hold cancel

[jcantrill]

/hold

[vparfonov]

/retest-required

[Clee2691]

/lgtm

[openshift-ci]

New changes are detected. LGTM label has been removed.

[jcantrill]

/hold cancel

[openshift-ci]

@vparfonov: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-using-bundle	842ba04	link	false	/test e2e-using-bundle

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.