logflow-sim

Whoever changes an rsyslog or Vector configuration rarely sees in advance which logs will land somewhere else afterwards — or nowhere at all. logflow-sim builds a normalised model from the configuration and simulates a message through it: which input matches, which ruleset is entered, which condition holds, which variable changes and which action fires, each with file and line. No call to the real daemon, no regex over the configuration text.

Diff mode replays real traffic through the old and the new version. As a GitHub Action, logflow-sim posts the result on the pull request — for example “127 of 25,567 messages change routing” — and can block the merge above a threshold. Detection impact goes one step further: Sigma rules run against the replayed traffic, which shows whether a routing change starves a SIEM detection of its data.

For migrations, logflow-sim translates a configuration into another dialect, say from rsyslog to the OpenTelemetry Collector, together with the field vocabulary of the target SIEM — through OCSF as a common schema, for Splunk, Elastic, Microsoft Sentinel, Chronicle, QRadar and more. Whatever does not translate without loss is reported as a diagnostic. A static validator, a command-line tool and an MCP server for AI assistants come with it.