github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-23 22:27:21 -04:00
Code Issues Projects Releases Packages Wiki Activity

fix regressions in input/gelf

Browse source 
- fixed regression that caused 'gelf listener died' on chunked messages
- moved client ip of the sender from `event['host']` to `event['source_host']` since this will overwrite the (probably hostname) in the GELF message with an IP address. The hostname is thus lost and would require resolving in a logstash filter or by modifying upstream GELF clients. This is sort of a regression in that previous versions of logstash would leave the `host` field alone and use the client[3] ip as part of the `@source_host`.
- previous versions did not remove the leading `_` from keys. In order to smooth the upgrade process, make this optional
with new `strip_leading_underscore` (boolean) config attribute. It's useful to keep this separate from `remap` since this
 restores previous behavior.
This commit is contained in:
joe miller 2013-11-15 23:50:33 +00:00 • committed by Jordan Sissel
parent 350c0887cd
commit 176bd664f8
1 changed files with 20 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

29
lib/logstash/inputs/gelf.rb
View file

@ -36,6 +36,14 @@ class LogStash::Inputs::Gelf < LogStash::Inputs::Base
# if no short_message, event["message"] is the raw json input
config :remap, :validate => :boolean, :default => true
# Whether or not to remove the leading '_' in GELF fields or leave them
# in place. (Logstash < 1.2 did not remove them by default.)
#
# _foo becomes foo
#
# Default is true
config :strip_leading_underscore, :validate => :boolean, :default => true
public
def initialize(params)
super
@ -85,12 +93,13 @@ class LogStash::Inputs::Gelf < LogStash::Inputs::Base
next if data.nil?
event = LogStash::Event.new(JSON.parse(data))
event["host"] = client[3]
event["source_host"] = client[3]
if event["timestamp"].is_a?(Numeric)
event["@timestamp"] = Time.at(event["timestamp"]).gmtime
event.remove("timestamp")
end
remap_gelf(event) if @remap
strip_leading_underscore(event) if @strip_leading_underscore
decorate(event)
output_queue << event
end
@ -115,13 +124,15 @@ class LogStash::Inputs::Gelf < LogStash::Inputs::Base
event["message"] = event["short_message"].dup
event.remove("short_message")
end
# Map all '_foo' fields to simply 'foo'
event.to_hash.keys.each do |key|
next unless key[0,1] == "_"
event[key[1..-1]] = event[key]
event.remove(key)
end
end # def remap_gelf
private
def strip_leading_underscore(event)
# Map all '_foo' fields to simply 'foo'
event.to_hash.keys.each do |key|
next unless key[0,1] == "_"
event[key[1..-1]] = event[key]
event.remove(key)
end
end # deef removing_leading_underscores
end # class LogStash::Inputs::Gelf