A note for the community
- Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment
Problem
The max_length schema description reads "Messages larger than this are truncated." — but in TCP mode an oversized message is dropped entirely (no event, no truncated version; the source keeps reading). In UDP mode max_length is ignored entirely.
Reproduction (Vector 0.55.0, syslog TCP, max_length: 60): send short → 500-char → short. Only the two short messages become events. The drop is invisible in component metrics (received/sent/discarded unchanged); only vector_component_errors_total{error_code="decoder_frame"} and the ERROR Failed framing bytes. log line record it.
Expected: either truncate as documented, or fix the wording to "drops". Ideally surface drops via a discarded-style metric. Note the generic framing options already have oversized_action (drop|truncate) — the syslog source just doesn't expose it.
Configuration
Version
0.55.0
Debug Output
Example Data
No response
Additional Context
No response
References
No response
A note for the community
Problem
The max_length schema description reads "Messages larger than this are truncated." — but in TCP mode an oversized message is dropped entirely (no event, no truncated version; the source keeps reading). In UDP mode max_length is ignored entirely.
Reproduction (Vector 0.55.0, syslog TCP, max_length: 60): send short → 500-char → short. Only the two short messages become events. The drop is invisible in component metrics (received/sent/discarded unchanged); only vector_component_errors_total{error_code="decoder_frame"} and the ERROR Failed framing bytes. log line record it.
Expected: either truncate as documented, or fix the wording to "drops". Ideally surface drops via a discarded-style metric. Note the generic framing options already have oversized_action (drop|truncate) — the syslog source just doesn't expose it.
Configuration
Version
0.55.0
Debug Output
Example Data
No response
Additional Context
No response
References
No response