From 7049967fa974cc89d394d0eee0a1c968442d5c5a Mon Sep 17 00:00:00 2001
From: Joshua Powers <powersj@influxdata.com>
Date: Mon, 6 Dec 2021 11:06:02 -0700
Subject: [PATCH] fix: ensure graylog spec fields not prefixed with '_'
 (#10209)

---
 plugins/outputs/graylog/graylog.go      | 22 ++++++++++++-
 plugins/outputs/graylog/graylog_test.go | 41 +++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/plugins/outputs/graylog/graylog.go b/plugins/outputs/graylog/graylog.go
index b408b6372be30..03762aeb108e6 100644
--- a/plugins/outputs/graylog/graylog.go
+++ b/plugins/outputs/graylog/graylog.go
@@ -30,6 +30,8 @@ const (
 	defaultTimeout         = 5 * time.Second
 )
 
+var defaultSpecFields = []string{"version", "host", "short_message", "full_message", "timestamp", "level", "facility", "line", "file"}
+
 type gelfConfig struct {
 	Endpoint        string
 	Connection      string
@@ -423,7 +425,13 @@ func (g *Graylog) serialize(metric telegraf.Metric) ([]string, error) {
 	}
 
 	for _, tag := range metric.TagList() {
-		if tag.Key != "host" {
+		if tag.Key == "host" {
+			continue
+		}
+
+		if fieldInSpec(tag.Key) {
+			m[tag.Key] = tag.Value
+		} else {
 			m["_"+tag.Key] = tag.Value
 		}
 	}
@@ -431,6 +439,8 @@ func (g *Graylog) serialize(metric telegraf.Metric) ([]string, error) {
 	for _, field := range metric.FieldList() {
 		if field.Key == g.ShortMessageField {
 			m["short_message"] = field.Value
+		} else if fieldInSpec(field.Key) {
+			m[field.Key] = field.Value
 		} else {
 			m["_"+field.Key] = field.Value
 		}
@@ -445,6 +455,16 @@ func (g *Graylog) serialize(metric telegraf.Metric) ([]string, error) {
 	return out, nil
 }
 
+func fieldInSpec(field string) bool {
+	for _, specField := range defaultSpecFields {
+		if specField == field {
+			return true
+		}
+	}
+
+	return false
+}
+
 func init() {
 	outputs.Add("graylog", func() telegraf.Output {
 		return &Graylog{
diff --git a/plugins/outputs/graylog/graylog_test.go b/plugins/outputs/graylog/graylog_test.go
index e8577fb43c3a8..f1516dc9fc4dc 100644
--- a/plugins/outputs/graylog/graylog_test.go
+++ b/plugins/outputs/graylog/graylog_test.go
@@ -14,10 +14,51 @@ import (
 	reuse "github.com/libp2p/go-reuseport"
 	"github.com/stretchr/testify/require"
 
+	"github.com/influxdata/telegraf/metric"
 	tlsint "github.com/influxdata/telegraf/plugins/common/tls"
 	"github.com/influxdata/telegraf/testutil"
 )
 
+func TestSerializer(t *testing.T) {
+	m1 := metric.New("testing",
+		map[string]string{
+			"verb": "GET",
+			"host": "hostname",
+		},
+		map[string]interface{}{
+			"full_message":  "full",
+			"short_message": "short",
+			"level":         "1",
+			"facility":      "demo",
+			"line":          "42",
+			"file":          "graylog.go",
+		},
+		time.Now(),
+	)
+
+	graylog := Graylog{}
+	result, err := graylog.serialize(m1)
+
+	require.NoError(t, err)
+
+	for _, r := range result {
+		var obj GelfObject
+		err = json.Unmarshal([]byte(r), &obj)
+		require.NoError(t, err)
+
+		require.Equal(t, obj["version"], "1.1")
+		require.Equal(t, obj["_name"], "testing")
+		require.Equal(t, obj["_verb"], "GET")
+		require.Equal(t, obj["host"], "hostname")
+		require.Equal(t, obj["full_message"], "full")
+		require.Equal(t, obj["short_message"], "short")
+		require.Equal(t, obj["level"], "1")
+		require.Equal(t, obj["facility"], "demo")
+		require.Equal(t, obj["line"], "42")
+		require.Equal(t, obj["file"], "graylog.go")
+	}
+}
+
 func TestWriteUDP(t *testing.T) {
 	tests := []struct {
 		name     string