[exporter/syslog] Fix handling of multiple structured data elements (#37927)

#### Description
As reported in issue #33300 this fixes the issue when there are more
than one structured data block in the structured_data attributes object.
Say you had a structured block like this:
```json
{
    "structured_data": {
        "a@123": {
            "a": "123"
        },
        "b@321": {
            "b": "321"
        }
    }
}
```

The expected output would then be two sd blocks, like [a@193
a="123"][b@193 b="321"]
, but instead the code returns one array, like [a@193 a="123" b@193
b="321"] which is wrong according to the
[RFC5424](https://datatracker.ietf.org/doc/html/rfc5424#section-6.3.5)

#### Link to tracking issue
Fixes #33300

#### Testing
A new test for "more than one SD field" was added in the commit, which
failed for the original code, but passes now with the fix.


#### Documentation

No documentation change needed.

---------

Co-authored-by: Andrzej Stencel <[email protected]>

Author: peffis

.chloggen/issue_33300.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: syslogexporter
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Fixes handling of multiple structured data elements
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [33300]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: Previous version added all structured data within one bracket pair. According to the RFC each structured data element should have its own bracket pair.
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

exporter/syslogexporter/rfc5424_formatter.go

@@ -6,6 +6,7 @@ package syslogexporter // import "github.com/open-telemetry/opentelemetry-collec
 import (
 	"fmt"
 	"strconv"
+	"strings"
 	"time"
 
 	"go.opentelemetry.io/collector/pdata/pcommon"
@@ -78,9 +79,9 @@ func (f *rfc5424Formatter) formatStructuredData(logRecord plog.LogRecord) string
 		return emptyValue
 	}
 
-	sdElements := []string{}
+	var sdBuilder strings.Builder
 	for key, val := range structuredDataAttributeValue.Map().AsRaw() {
-		sdElements = append(sdElements, key)
+		sdElements := []string{key}
 		vval, ok := val.(map[string]any)
 		if !ok {
 			continue
@@ -92,8 +93,9 @@ func (f *rfc5424Formatter) formatStructuredData(logRecord plog.LogRecord) string
 			}
 			sdElements = append(sdElements, fmt.Sprintf("%s=\"%s\"", k, vv))
 		}
+		sdBuilder.WriteString(fmt.Sprint(sdElements))
 	}
-	return fmt.Sprint(sdElements)
+	return sdBuilder.String()
 }
 
 func (f *rfc5424Formatter) formatMessage(logRecord plog.LogRecord) string {

exporter/syslogexporter/rfc5424_formatter_test.go

@@ -6,6 +6,7 @@ package syslogexporter
 import (
 	"fmt"
 	"regexp"
+	"strings"
 	"testing"
 	"time"
 
@@ -85,6 +86,68 @@ func TestRFC5424Formatter(t *testing.T) {
 	assert.Contains(t, actual, "UserID=\"Tester2\"")
 	assert.Contains(t, actual, "PEN=\"27389\"")
 
+	// Test structured data (more than one field)
+	expectedRegex = "\\<165\\>1 2003-08-24T12:14:15.000003Z 192\\.0\\.2\\.1 myproc 8710 - " +
+		"\\[(\\S+ \\S+ \\S+)\\]" +
+		"\\[(\\S+ \\S+ \\S+)\\]" +
+		" It's time to make the do-nuts\\.\n"
+	logRecord = plog.NewLogRecord()
+	logRecord.Attributes().PutStr("appname", "myproc")
+	logRecord.Attributes().PutStr("hostname", "192.0.2.1")
+	logRecord.Attributes().PutStr("message", "It's time to make the do-nuts.")
+	logRecord.Attributes().PutInt("priority", 165)
+	logRecord.Attributes().PutStr("proc_id", "8710")
+	logRecord.Attributes().PutEmptyMap("structured_data")
+	structuredData, found = logRecord.Attributes().Get("structured_data")
+	require.True(t, found)
+	structuredData.Map().PutEmptyMap("A@123")
+	structuredDataSubmap, found = structuredData.Map().Get("A@123")
+	require.True(t, found)
+	structuredDataSubmap.Map().PutStr("A", "123")
+	structuredDataSubmap.Map().PutStr("UserHostAddress", "192.168.2.132")
+	structuredData.Map().PutEmptyMap("B@321")
+	structuredDataSubmap, found = structuredData.Map().Get("B@321")
+	require.True(t, found)
+	structuredDataSubmap.Map().PutStr("B", "321")
+	structuredDataSubmap.Map().PutStr("UserHostAddress", "192.168.2.132")
+	logRecord.Attributes().PutInt("version", 1)
+
+	timestamp, err = time.Parse(time.RFC3339Nano, "2003-08-24T05:14:15.000003-07:00")
+	require.NoError(t, err)
+	logRecord.SetTimestamp(pcommon.NewTimestampFromTime(timestamp))
+
+	actual = newRFC5424Formatter(false).format(logRecord)
+	assert.NoError(t, err)
+
+	// check that the output message is of the right form
+	matched, err = regexp.MatchString(expectedRegex, actual)
+	assert.NoError(t, err)
+	assert.Truef(t, matched, "unexpected form of formatted message, formatted message: %s, regexp: %s", actual, expectedRegex)
+	regex := regexp.MustCompile(expectedRegex)
+	submatches := regex.FindStringSubmatch(actual)
+	// make sure we have received exactly two SD-elements
+	assert.Lenf(t, submatches, 3,
+		"expected 2 SD-elements but got %d", len(submatches)-1)
+
+	// validate all found SD-elements
+	for _, submatch := range submatches[1:] {
+		elements := strings.Split(submatch, " ")
+		// make sure that the element has three substrings
+		// one for the key and two key-value pairs
+		assert.Len(t, elements, 3, "expected 3 elements in SD-element")
+
+		// make sure the first element is the key in the structured data map
+		submap, found := structuredData.Map().Get(elements[0])
+		require.True(t, found)
+
+		// make sure each element in the found submap is rendered
+		// somewhere in the found SD-element string
+		for k, v := range submap.Map().AsRaw() {
+			attribute := fmt.Sprintf("%s=\"%v\"", k, v)
+			assert.Contains(t, submatch, attribute)
+		}
+	}
+
 	// Test defaults
 	expected = "<165>1 2003-08-24T12:14:15.000003Z - - - - -\n"
 	logRecord = plog.NewLogRecord()