mirror of
https://github.com/elastic/logstash.git
synced 2025-04-25 07:07:54 -04:00
- Fix Log#index_dir
- SYNCDELAY for indexing to 10 seconds, for debugging/testing. - Batch search results to 10 per message block
This commit is contained in:
parent
14d65e1522
commit
96e4881de2
5 changed files with 26 additions and 18 deletions
18
bin/agent.rb
18
bin/agent.rb
|
@ -21,22 +21,30 @@ class Agent < LogStash::Net::MessageClient
|
||||||
Thread.new do
|
Thread.new do
|
||||||
File::Tail::Since.new("/var/log/messages").tail do |line|
|
File::Tail::Since.new("/var/log/messages").tail do |line|
|
||||||
line.chomp!
|
line.chomp!
|
||||||
puts "Found line: #{line}"
|
index("linux-syslog", line)
|
||||||
index(line)
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
Thread.new do
|
||||||
|
File::Tail::Since.new("/b/access").tail do |line|
|
||||||
|
line.chomp!
|
||||||
|
index("httpd-access", line)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
end # def start_log_watcher
|
end # def start_log_watcher
|
||||||
|
|
||||||
def index(string)
|
def index(type, string)
|
||||||
ier = LogStash::Net::Messages::IndexEventRequest.new
|
ier = LogStash::Net::Messages::IndexEventRequest.new
|
||||||
ier.log_type = "linux-syslog"
|
ier.log_type = type
|
||||||
ier.log_data = string
|
ier.log_data = string
|
||||||
ier.metadata["source_host"] = @hostname
|
ier.metadata["source_host"] = @hostname
|
||||||
|
|
||||||
sent = false
|
sent = false
|
||||||
while !sent
|
while !sent
|
||||||
begin
|
begin
|
||||||
puts "Trying to send: #{ier.inspect}"
|
$stdout.write(".")
|
||||||
|
$stdout.flush
|
||||||
|
#puts "Trying to send: #{ier.inspect}"
|
||||||
sendmsg(ier)
|
sendmsg(ier)
|
||||||
sent = true
|
sent = true
|
||||||
rescue LogStash::Net::NoSocket
|
rescue LogStash::Net::NoSocket
|
||||||
|
|
|
@ -43,7 +43,7 @@ module LogStash
|
||||||
end
|
end
|
||||||
|
|
||||||
def index_dir
|
def index_dir
|
||||||
return "#{@home}/var/indexes/#{@attrs["log:name"]}"
|
return "#{@home}/var/indexes/#{@attrs["log:type"]}"
|
||||||
end
|
end
|
||||||
|
|
||||||
def create_index
|
def create_index
|
||||||
|
|
|
@ -12,7 +12,7 @@ module LogStash; module Net;
|
||||||
@expected_checksum = checksum
|
@expected_checksum = checksum
|
||||||
@data = data
|
@data = data
|
||||||
super("Corrupt message read. Expected checksum #{checksum}, got " +
|
super("Corrupt message read. Expected checksum #{checksum}, got " +
|
||||||
"#{data.checksum} / #{data.inspect}")
|
"#{data.checksum}")
|
||||||
end # def initialize
|
end # def initialize
|
||||||
end # class MessageReaderCorruptMessage
|
end # class MessageReaderCorruptMessage
|
||||||
|
|
||||||
|
@ -87,7 +87,6 @@ module LogStash; module Net;
|
||||||
if have >= need
|
if have >= need
|
||||||
length, checksum, data = @buffer.unpack("NNA#{need - HEADERSIZE}")
|
length, checksum, data = @buffer.unpack("NNA#{need - HEADERSIZE}")
|
||||||
if data.checksum != checksum
|
if data.checksum != checksum
|
||||||
puts @buffer.inspect[0..200]
|
|
||||||
raise MessageReaderCorruptMessage.new(checksum, data)
|
raise MessageReaderCorruptMessage.new(checksum, data)
|
||||||
end
|
end
|
||||||
return true
|
return true
|
||||||
|
|
|
@ -31,9 +31,6 @@ module LogStash; module Net
|
||||||
data = self.encode
|
data = self.encode
|
||||||
puts "Writing #{data.length} bytes to #{sock}"
|
puts "Writing #{data.length} bytes to #{sock}"
|
||||||
bytestream = [data.length, data.checksum, data].pack("NNA*")
|
bytestream = [data.length, data.checksum, data].pack("NNA*")
|
||||||
if bytestream.length < 100
|
|
||||||
puts bytestream.inspect
|
|
||||||
end
|
|
||||||
sock.write(bytestream)
|
sock.write(bytestream)
|
||||||
self.clear
|
self.clear
|
||||||
end # def sendto
|
end # def sendto
|
||||||
|
|
|
@ -13,7 +13,7 @@ require 'config'
|
||||||
|
|
||||||
module LogStash; module Net; module Servers
|
module LogStash; module Net; module Servers
|
||||||
class Indexer < LogStash::Net::MessageServer
|
class Indexer < LogStash::Net::MessageServer
|
||||||
SYNCDELAY = 60
|
SYNCDELAY = 10
|
||||||
|
|
||||||
def initialize(addr="0.0.0.0", port=3001)
|
def initialize(addr="0.0.0.0", port=3001)
|
||||||
# 'super' is not the same as 'super()', and we want super().
|
# 'super' is not the same as 'super()', and we want super().
|
||||||
|
@ -26,7 +26,6 @@ module LogStash; module Net; module Servers
|
||||||
def IndexEventRequestHandler(request)
|
def IndexEventRequestHandler(request)
|
||||||
response = LogStash::Net::Messages::IndexEventResponse.new
|
response = LogStash::Net::Messages::IndexEventResponse.new
|
||||||
response.id = request.id
|
response.id = request.id
|
||||||
puts request.inspect
|
|
||||||
|
|
||||||
log_type = request.log_type
|
log_type = request.log_type
|
||||||
entry = $logs[log_type].parse_entry(request.log_data)
|
entry = $logs[log_type].parse_entry(request.log_data)
|
||||||
|
@ -63,17 +62,22 @@ module LogStash; module Net; module Servers
|
||||||
:tokenized_fields => reader.tokenized_fields,
|
:tokenized_fields => reader.tokenized_fields,
|
||||||
:or_default => false)
|
:or_default => false)
|
||||||
query = qp.parse(request.query)
|
query = qp.parse(request.query)
|
||||||
|
results = []
|
||||||
search.search_each(query, :limit => :all,
|
search.search_each(query, :limit => :all,
|
||||||
:sort => "@DATE") do |docid, score|
|
:sort => "@DATE") do |docid, score|
|
||||||
result = reader[docid][:@LINE]
|
result = reader[docid][:@LINE]
|
||||||
|
results << result
|
||||||
|
if results.length > 10
|
||||||
response = LogStash::Net::Messages::SearchResponse.new
|
response = LogStash::Net::Messages::SearchResponse.new
|
||||||
response.id = request.id
|
response.id = request.id
|
||||||
response.results = [result]
|
response.results = results
|
||||||
yield response
|
yield response
|
||||||
|
results = []
|
||||||
|
end
|
||||||
end
|
end
|
||||||
response = LogStash::Net::Messages::SearchResponse.new
|
response = LogStash::Net::Messages::SearchResponse.new
|
||||||
response.id = request.id
|
response.id = request.id
|
||||||
response.results = []
|
response.results = results
|
||||||
response.finished = true
|
response.finished = true
|
||||||
yield response
|
yield response
|
||||||
end
|
end
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue