Apache Software Foundation / SeaTunnel
Merged upstreamFeatureMerged Sep 14, 2026

Add RFC 5424 Syslog sink over TLS

Added an opt-in Syslog sink with RFC 5424 message encoding, RFC 5425 octet-counted framing, and validated TLS/mTLS transport.

apache/seatunnel · #12279

New secure logging integration

SeaTunnel batch and streaming jobs can send standards-framed Syslog messages to TLS-enabled receivers.

Problem

Users requested Syslog connectivity for log collection, while SeaTunnel lacked this native sink. Transport must preserve message boundaries and surface failures rather than silently accepting unsuccessful writes.

Approach

Adds structured-data escaping, validated TLS/mTLS, bounded writes, checkpoint failure propagation, registration, examples, documentation, and receiver integration tests. The sink is independent of the separate Syslog source implementation.

Impact and scope

  • Connects batch and streaming pipelines to standards-compatible Syslog receivers without a custom sink implementation.
  • Uses encrypted transport and optional mutual authentication, with explicit framing and structured-data escaping.
  • Propagates transport failures through writes and checkpoints. This TLS-only slice does not promise automatic retries or durable delivery.

Validation

  • The PR reports 24 focused tests passing on both Java 8 and Java 11, covering TLS, framing, serialization, and transport failures.
  • Selected Zeta, Flink 1.13.6, and Spark 3.3.0 runs passed against independent syslog-ng 4.12.0; password masking, worker certificate access, and cleanup were verified.
  • Maintainer davidzollo approved the feature, the final Build check passed, and the GitHub-verified merge commit credits Goutam Adwant. Selected engine runs are not a claim of full-matrix validation.