Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions src/content/docs/integrations/udp.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ Use the IP address `0.0.0.0` to listen on all available network interfaces.
## Examples

Use <Op>from_udp</Op> to receive UDP datagrams as
structured events containing message data and peer information. For sending, use
<Op>save_udp</Op> with a write operator.
structured events containing message data and peer information. Use <Op>to_udp</Op>
to send one UDP datagram per event directly from structured data.

### Receive syslog messages over UDP

Expand All @@ -29,6 +29,5 @@ this = data.parse_syslog()

```tql
from {message: "Tenzir"}
write_ndjson
save_udp "1.2.3.4:8080"
to_udp "1.2.3.4:8080", message=message
```
12 changes: 12 additions & 0 deletions src/content/docs/reference/operators.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -695,6 +695,10 @@ operators:
description: 'Saves bytes to a UDP socket.'
example: 'save_udp "0.0.0.0:8090"'
path: 'reference/operators/save_udp'
- name: 'to_udp'
description: 'Sends one UDP datagram per input event.'
example: 'to_udp "127.0.0.1:514", message=this'
path: 'reference/operators/to_udp'
- name: 'save_zmq'
description: 'Sends bytes as ZeroMQ messages.'
example: 'save_zmq'
Expand Down Expand Up @@ -2498,6 +2502,14 @@ save_udp "0.0.0.0:8090"

</ReferenceCard>

<ReferenceCard title="to_udp" description="Sends one UDP datagram per input event." href="/reference/operators/to_udp">
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Place to_udp in the Events operator section

This new card is inserted in the bytes CardGrid (between save_udp and save_zmq) even though to_udp is documented as an event output operator (category: Outputs/Events in reference/operators/to_udp.mdx). On /reference/operators, users browse by section headings, so keeping to_udp under bytes makes it easy to miss and misclassifies its usage model. Move it to the Events section so discoverability and categorization match the operator contract.

Useful? React with 👍 / 👎.


```tql
to_udp "127.0.0.1:514", message=this
```

</ReferenceCard>

<ReferenceCard title="save_zmq" description="Sends bytes as ZeroMQ messages." href="/reference/operators/save_zmq">

```tql
Expand Down
59 changes: 59 additions & 0 deletions src/content/docs/reference/operators/to_udp.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
---
title: to_udp
category: Outputs/Events
example: 'to_udp "127.0.0.1:514", message=this'
---

import Integration from '@components/see-also/Integration.astro';
import Op from '@components/see-also/Op.astro';

Sends one UDP datagram per input event.

```tql
to_udp endpoint:str, [message=string|blob|record|null]
```

## Description

Sends one UDP datagram per input event to a fixed remote UDP endpoint.

### `endpoint: str`

The address of the remote endpoint. Must be of the format `host:port`. The
optional `udp://` prefix is accepted but not required.

### `message = string|blob|record|null (optional)`

An expression that is evaluated once per input event and must produce one of
the following types:

- `string` values are sent as UTF-8 bytes.
- `blob` values are sent verbatim.
- `record` values are serialized as compact JSON.
- `null` values are skipped with a warning.

All other result types are ignored with a warning.

If you omit `message`, the operator sends the whole event as compact JSON.

## Examples

Send a field as a UDP datagram:

```tql
from {message: "hello"}
to_udp "127.0.0.1:514", message=message
```

Send the full event as compact JSON:

```tql
from {service: "dns", status: "ok"}
to_udp "127.0.0.1:514"
```

## See Also

- <Op>from_udp</Op>
- <Op>save_udp</Op>
- <Integration>udp</Integration>
Loading