Skip to content
Open
Show file tree
Hide file tree
Changes from 4 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/content/docs/integrations/syslog.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ from {
message: " PARENT process running...",
}
write_syslog
save_udp "1.2.3.4:514"
to_udp "1.2.3.4:514"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve syslog payload when switching to to_udp

This example now pipes write_syslog directly into to_udp without a message argument, but to_udp defaults to sending each input event as compact JSON when message is omitted. In this specific pipeline, that changes the wire payload from a raw RFC 5424 syslog line to JSON-encoded output, so readers following the example will not actually emit the message format described below the snippet.

Useful? React with 👍 / 👎.

```

This pipeline sends the following RFC 5424-formatted message to
Expand Down
7 changes: 3 additions & 4 deletions src/content/docs/integrations/udp.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ Use the IP address `0.0.0.0` to listen on all available network interfaces.
## Examples

Use <Op>from_udp</Op> to receive UDP datagrams as
structured events containing message data and peer information. For sending, use
<Op>save_udp</Op> with a write operator.
structured events containing message data and peer information. Use <Op>to_udp</Op>
to send one UDP datagram per event directly from structured data.

### Receive syslog messages over UDP

Expand All @@ -29,6 +29,5 @@ this = data.parse_syslog()

```tql
from {message: "Tenzir"}
write_ndjson
save_udp "1.2.3.4:8080"
to_udp "1.2.3.4:8080", message=message
```
24 changes: 6 additions & 18 deletions src/content/docs/reference/operators.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -451,10 +451,6 @@ operators:
description: 'Loads bytes from a TCP or TLS connection.'
example: 'load_tcp "0.0.0.0:8090" { read_json }'
path: 'reference/operators/load_tcp'
- name: 'load_udp'
description: 'Loads bytes from a UDP socket.'
example: 'load_udp "0.0.0.0:8090"'
path: 'reference/operators/load_udp'
- name: 'load_zmq'
description: 'Receives ZeroMQ messages.'
example: 'load_zmq'
Expand Down Expand Up @@ -691,10 +687,10 @@ operators:
description: 'Saves bytes to a TCP or TLS connection.'
example: 'save_tcp "0.0.0.0:8090", tls=true'
path: 'reference/operators/save_tcp'
- name: 'save_udp'
description: 'Saves bytes to a UDP socket.'
example: 'save_udp "0.0.0.0:8090"'
path: 'reference/operators/save_udp'
- name: 'to_udp'
description: 'Sends one UDP datagram per input event.'
example: 'to_udp "127.0.0.1:514"'
path: 'reference/operators/to_udp'
- name: 'save_zmq'
description: 'Sends bytes as ZeroMQ messages.'
example: 'save_zmq'
Expand Down Expand Up @@ -2134,14 +2130,6 @@ load_tcp "0.0.0.0:8090" { read_json }

</ReferenceCard>

<ReferenceCard title="load_udp" description="Loads bytes from a UDP socket." href="/reference/operators/load_udp">

```tql
load_udp "0.0.0.0:8090"
```

</ReferenceCard>

<ReferenceCard title="load_zmq" description="Receives ZeroMQ messages." href="/reference/operators/load_zmq">

```tql
Expand Down Expand Up @@ -2490,10 +2478,10 @@ save_tcp "0.0.0.0:8090", tls=true

</ReferenceCard>

<ReferenceCard title="save_udp" description="Saves bytes to a UDP socket." href="/reference/operators/save_udp">
<ReferenceCard title="to_udp" description="Sends one UDP datagram per input event." href="/reference/operators/to_udp">
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Place to_udp in the Events operator section

This new card is inserted in the bytes CardGrid (between save_udp and save_zmq) even though to_udp is documented as an event output operator (category: Outputs/Events in reference/operators/to_udp.mdx). On /reference/operators, users browse by section headings, so keeping to_udp under bytes makes it easy to miss and misclassifies its usage model. Move it to the Events section so discoverability and categorization match the operator contract.

Useful? React with 👍 / 👎.


```tql
save_udp "0.0.0.0:8090"
to_udp "127.0.0.1:514"
```

</ReferenceCard>
Expand Down
1 change: 0 additions & 1 deletion src/content/docs/reference/operators/from.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,6 @@ load_tcp "tcp://0.0.0.0:12345", parallel=10 {
| `s3` | <Op>load_s3</Op> | `from "s3://bucket/file.json"` |
| `sqs` | <Op>load_sqs</Op> | `from "sqs://my-queue" { read_json }` |
| `tcp` | <Op>load_tcp</Op> | `from "tcp://127.0.0.1:13245" { read_json }` |
| `udp` | <Op>load_udp</Op> | `from "udp://127.0.0.1:56789" { read_json }` |
| `zmq` | <Op>load_zmq</Op> | `from "zmq://127.0.0.1:56789" { read_json }` |
Comment on lines 152 to 153
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restore UDP scheme mapping in from URI table

Removing the udp row from the from URI-scheme table makes the reference internally inconsistent: other docs in this repo still instruct users to run from "udp://..." (for example, reference/operators/assert_throughput.mdx), so readers can no longer discover the documented UDP from path from the canonical scheme list. Either keep the UDP mapping here or update all remaining UDP-URI usage docs in the same change.

Useful? React with 👍 / 👎.


Please see the respective operator pages for details on the URI's locator format.
Expand Down
4 changes: 1 addition & 3 deletions src/content/docs/reference/operators/from_udp.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ from_udp endpoint:string, [resolve_hostnames=bool], [binary=bool]
Listens for UDP datagrams on the specified endpoint and outputs each datagram as
a structured event containing the data and peer information.

Unlike <Op>load_udp</Op>, which outputs raw bytes,
`from_udp` produces structured events with metadata about the sender.

### `endpoint: string`
Expand Down Expand Up @@ -91,6 +90,5 @@ select data

## See Also

- <Op>load_udp</Op>
- <Op>save_udp</Op>
- <Op>to_udp</Op>
- <Integration>udp</Integration>
55 changes: 0 additions & 55 deletions src/content/docs/reference/operators/load_udp.mdx

This file was deleted.

37 changes: 0 additions & 37 deletions src/content/docs/reference/operators/save_udp.mdx

This file was deleted.

1 change: 0 additions & 1 deletion src/content/docs/reference/operators/to.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,6 @@ If no scheme is present, the connector attempts to save to the local filesystem.
| `s3` | <Op>save_s3</Op> | `to "s3://bucket/file.json"` |
| `sqs` | <Op>save_sqs</Op> | `to "sqs://my-queue" { write_json }` |
| `tcp` | <Op>save_tcp</Op> | `to "tcp://127.0.0.1:56789" { write_json }` |
| `udp` | <Op>save_udp</Op> | `to "udp://127.0.0.1:56789" { write_json }` |
| `zmq` | <Op>save_zmq</Op> | `to "zmq://127.0.0.1:56789" { write_json }` |
| `smtp`, `smtps`, `mailto`, `email` | <Op>save_email</Op> | `to "smtp://john@example.com"` |

Expand Down
58 changes: 58 additions & 0 deletions src/content/docs/reference/operators/to_udp.mdx
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
---
title: to_udp
category: Outputs/Events
example: 'to_udp "127.0.0.1:514"'
---

import Integration from '@components/see-also/Integration.astro';
import Op from '@components/see-also/Op.astro';

Sends one UDP datagram per input event.

```tql
to_udp endpoint:string, [message=string|blob|record]
```

## Description

Sends one UDP datagram per input event to a fixed remote UDP endpoint.

### `endpoint: string`

The address of the remote endpoint. Must be of the format `host:port`. The
optional `udp://` prefix is accepted but not required.

### `message = string|blob|record (optional)`

An expression that is evaluated once per input event and must produce one of
the following types:

- `string` values are sent as UTF-8 bytes.
- `blob` values are sent verbatim.
- `record` values are serialized as compact JSON.
- `null` values are skipped with a warning.

All other result types are ignored with a warning.

If you omit `message`, the operator sends the whole event as compact JSON.

## Examples

Send a field as a UDP datagram:

```tql
from {message: "hello"}
to_udp "127.0.0.1:514", message=message
```

Send the full event as compact JSON:

```tql
from {service: "dns", status: "ok"}
to_udp "127.0.0.1:514"
```

## See Also

- <Op>from_udp</Op>
- <Integration>udp</Integration>
Loading