Syslog receiver doesn't properly set UDP/TCP protocol for k8s service

[geoffreytran]

Unable to use the syslog receiver endpoints for UDP because the k8s server port protocol is always TCP. It doesn't appear to detect the proper protocol type for the syslog receiver.

      syslog:
        tcp:
          listen_address: 0.0.0.0:1468
        udp:
          listen_address: 0.0.0.0:5514
        protocol: rfc5424
        location: UTC

The configuration above results in just the k8s service definition for the port 5514 as TCP. It should result in both the TCP 1428 and UDP 5514.

      syslog:
        udp:
          listen_address: 0.0.0.0:5514
        protocol: rfc5424
        location: UTC

This configuration results in the k8s service definition of TCP 5514 rather than the expected results of UDP 5514.

[pavolloffay]

@geoffreytran would you like to submit a PR to fix this?

[binjip978]

Right now generic receiver assumes that only one port will chosen and udp will be picked first, this is possible to fix by writing a new receiver, but what actual problem such configuration solves? What the point of streaming syslog data from UDP and TCP in parallel? From syslog protocol RFC https://datatracker.ietf.org/doc/html/rfc5424 they recommend to use tcp.

[oldium]

The TCP/UDP ServicePort distinction is addressed in #2619. The problem that both tcp and udp cannot be specified in single syslog entry cannot be fixed in that Pull Request, the issue is actually in the collector itself https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/pkg/stanza/operator/input/syslog/syslog.go#L48-L115 - it parses either TCP or UDP config - in this order.