fix(syslog): quote payloadKey path to prevent VRL evaluation as expression

internal/generator/vector/output/syslog/syslog.go

@@ -125,16 +125,14 @@ for_each(excluded_fields) -> |_index, field| {
 
 	payloadKeyConfiguredVRL = `
 # Payload key configured, going to use the payload key for .message field
-payload_key = %s
-if payload_key != null && payload_key != "" {
-  payload_key = string!(payload_key)
-  path = split!(payload_key, ".")
-  value, err = get(., path)
-  if err == null && value != null {
-    .message = value
-  } else {
-    log("payload_key not found in event, skipping", level: "warn")
-  }
+payload_key = "%s"
+if starts_with(payload_key, ".") {
+  payload_key = slice!(payload_key, 1)
+}
+path = split!(payload_key, ".")
+value, err = get(., path)
+if err == null && value != null {
+  .message = value
 } else {
   excluded_fields = ["_internal", "_syslog"]
   temp = .
@@ -239,7 +237,7 @@ func parseEncoding(inputs []string, o *obs.Syslog) types.Transform {
 	vrls = append(vrls, facilitySeverityConversionVRL)
 
 	if key := PayloadKey(o.PayloadKey); key != "" {
-		vrls = append(vrls, fmt.Sprintf(payloadKeyConfiguredVRL, key))
+		vrls = append(vrls, fmt.Sprintf(payloadKeyConfiguredVRL, strings.ReplaceAll(key, `"`, `\"`)))
 	} else {
 		vrls = append(vrls, payloadKeyDefaultVRL)
 	}

internal/generator/vector/output/syslog/tls_with_field_references.toml

@@ -50,16 +50,14 @@ if exists(._syslog.severity) && !is_null(._syslog.severity) {
 }
 
 # Payload key configured, going to use the payload key for .message field
-payload_key = .payload_key
-if payload_key != null && payload_key != "" {
-  payload_key = string!(payload_key)
-  path = split!(payload_key, ".")
-  value, err = get(., path)
-  if err == null && value != null {
-    .message = value
-  } else {
-    log("payload_key not found in event, skipping", level: "warn")
-  }
+payload_key = ".payload_key"
+if starts_with(payload_key, ".") {
+  payload_key = slice!(payload_key, 1)
+}
+path = split!(payload_key, ".")
+value, err = get(., path)
+if err == null && value != null {
+  .message = value
 } else {
   excluded_fields = ["_internal", "_syslog"]
   temp = .

internal/generator/vector/output/syslog/udp_with_every_setting.toml

@@ -49,16 +49,14 @@ if exists(._syslog.severity) && !is_null(._syslog.severity) {
 }
 
 # Payload key configured, going to use the payload key for .message field
-payload_key = .plKey
-if payload_key != null && payload_key != "" {
-  payload_key = string!(payload_key)
-  path = split!(payload_key, ".")
-  value, err = get(., path)
-  if err == null && value != null {
-    .message = value
-  } else {
-    log("payload_key not found in event, skipping", level: "warn")
-  }
+payload_key = ".plKey"
+if starts_with(payload_key, ".") {
+  payload_key = slice!(payload_key, 1)
+}
+path = split!(payload_key, ".")
+value, err = get(., path)
+if err == null && value != null {
+  .message = value
 } else {
   excluded_fields = ["_internal", "_syslog"]
   temp = .

test/functional/outputs/syslog/rfc5424_test.go

@@ -115,6 +115,35 @@ var _ = Describe("[Functional][Outputs][Syslog] RFC5424 tests", func() {
 		Entry("should include the message when payloadkey is not found", `{.structured.appname_key||"none"}`, `{.structured.msgid_key||"none"}`, `{.structured.procid_key||"none"}`, "{.key_not_available}"),
 	)
 
+	It("should set message to the value of the specified payload key field", func() {
+		obstestruntime.NewClusterLogForwarderBuilder(framework.Forwarder).
+			FromInput(obs.InputTypeApplication).
+			WithParseJson().
+			ToSyslogOutput(obs.SyslogRFC5424, func(output *obs.OutputSpec) {
+				output.Syslog.Facility = "user"
+				output.Syslog.Severity = "debug"
+				output.Syslog.PayloadKey = "{.structured.msgcontent}"
+			})
+		Expect(framework.Deploy()).To(BeNil())
+
+		record := `{"msgcontent":"My life is my message","appname_key":"rec_appname"}`
+		crioMessage := functional.NewFullCRIOLogMessage(functional.CRIOTime(time.Now()), record)
+		Expect(framework.WriteMessagesToApplicationLog(crioMessage, 1)).To(BeNil())
+
+		outputlogs, err := framework.ReadRawApplicationLogsFrom(string(obs.OutputTypeSyslog))
+		Expect(err).To(BeNil(), "Expected no errors reading the logs")
+		Expect(outputlogs).To(HaveLen(1), "Expected the receiver to receive the message")
+
+		fields := strings.Split(outputlogs[0], " - ")
+		payload := strings.TrimSpace(fields[1])
+		Expect(payload).To(Equal("My life is my message"),
+			fmt.Sprintf("Expected payload to be the value of the specified payloadKey field, got: %q", payload))
+
+		collectorLogs, err := framework.ReadCollectorLogs()
+		Expect(err).To(BeNil())
+		Expect(collectorLogs).ToNot(ContainSubstring("payload_key not found in event"))
+	})
+
 	Describe("configured with values for facility,severity", func() {
 		It("should use values from the record", func() {
 			obstestruntime.NewClusterLogForwarderBuilder(framework.Forwarder).