Add support for ~UDP~ Datagram unix socket input

[phlax]

Describe the enhancement:

There is support for unix socket inputs in filebeat from version 7.8

This is done using protocol.unix as described here

This creates a TCP socket - but eg rsyslog assumes UDP

for ref, the ticket where support was added #10934

Describe a specific use case for the enhancement or feature:

use with any syslog engine that outputs to a UDP socket

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[andresrc]

We currently support syslog via UDP. Can you be more specific regarding what's missing?

Thanks

[phlax]

i followed the above instructions, and then set rsyslog - the default on debian - to output to the input socket.

That didnt work, as in i received no logs.

I then tested by creating a socket connection to the filebeat socket input myself.

First with tcp . This worked - echoing some "logs" into the socket resulted in indexed logs in kibana.

I then tried again with udp - which silently (iirc) failed - as in no log output.

This may work with other implementations of syslog but with the default on debian it seems to fail

[phlax]

To be absolutely clear this is regarding unix socket input - no doubt network udp works

[dcode]

I think the specific request is support for UNIX datagram socket versus the newly added support for UNIX stream socket.

[phlax]

mostly yes - but the protocol isnt really unix and this also makes it confusing