new source: dmesg

[Hoverbear]

Inspired by the output of https://github.com/polyverse/rmesg, we noted that a source which creates new events from kernel dmesg logs.

It should turn each dmesg event into a Vector event.

[sources.kernel_dmesg]
type = "dmesg"

We can use rmesg to do this.

[MOZGIII]

Would be useful at #5362

[binarylogic]

@MOZGIII in what way? I'm curious how critical this is. I'd like to see if we get more user demand for this feature.

[gvalkov]

This would be useful and if it was available, we would use it process nftables/iptables log messages from the kernel log.

Instead of providing a separate source, you could also extend the capabilities of the journald source (i.e. journalctl SYSLOG_IDENTIFIER=kernel or journalctl -k).

[jszwedko]

Just noting here that I'm adding 'ProtectKernelLogs=yes` as part of #6555 so if we do implement this, we should remove that setting (or guide users to if they use the dmesg source).