github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 14:47:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

gelfin

Browse source
This commit is contained in:
Kurt Hurtado 2014-02-27 00:03:43 -08:00
parent 6c70d9926d
commit e2818ac884
1 changed files with 16 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

36
lib/logstash/inputs/gelf.rb
View file

@ -4,12 +4,11 @@ require "logstash/inputs/base"
require "logstash/namespace" require "logstash/namespace"
require "socket" require "socket"
# Read gelf messages as events over the network. # This input will read GELF messages as events over the network,
# making it a good choice if you already use Graylog2 today.
# #
# This input is a good choice if you already use graylog2 today. # The main use case for this input is to leverage existing GELF
# # logging libraries such as the GELF log4j appender.
# The main reasoning for this input is to leverage existing GELF
# logging libraries such as the gelf log4j appender
# #
class LogStash::Inputs::Gelf < LogStash::Inputs::Base class LogStash::Inputs::Gelf < LogStash::Inputs::Base
config_name "gelf" config_name "gelf"
@ -17,31 +16,28 @@ class LogStash::Inputs::Gelf < LogStash::Inputs::Base
default :codec, "plain" default :codec, "plain"
# The address to listen on # The IP address or hostname to listen on.
config :host, :validate => :string, :default => "0.0.0.0" config :host, :validate => :string, :default => "0.0.0.0"
# The port to listen on. Remember that ports less than 1024 (privileged # The port to listen on. Remember that ports less than 1024 (privileged
# ports) may require root to use. # ports) may require root to use.
config :port, :validate => :number, :default => 12201 config :port, :validate => :number, :default => 12201
# Whether or not to remap the gelf message fields to logstash event fields or # Whether or not to remap the GELF message fields to Logstash event fields or
# leave them intact. # leave them intact.
# #
# Default is true # Remapping converts the following GELF fields to Logstash equivalents:
# #
# Remapping converts the following gelf fields to logstash equivalents: # * `full_message` becomes event["message"].
# # * if there is no `full_message`, `short_message` becomes event["message"].
# * event["message"] becomes full_message
# if no full_message, use event["message"] becomes short_message
# if no short_message, event["message"] is the raw json input
config :remap, :validate => :boolean, :default => true config :remap, :validate => :boolean, :default => true
# Whether or not to remove the leading '_' in GELF fields or leave them # Whether or not to remove the leading '_' in GELF fields or leave them
# in place. (Logstash < 1.2 did not remove them by default.) # in place. (Logstash < 1.2 did not remove them by default.). Note that
# #
# _foo becomes foo
# #
# Default is true # e.g. `\_foo` becomes `foo`
#
config :strip_leading_underscore, :validate => :boolean, :default => true config :strip_leading_underscore, :validate => :boolean, :default => true
public public
@ -72,7 +68,7 @@ class LogStash::Inputs::Gelf < LogStash::Inputs::Base
def udp_listener(output_queue) def udp_listener(output_queue)
@logger.info("Starting gelf listener", :address => "#{@host}:#{@port}") @logger.info("Starting gelf listener", :address => "#{@host}:#{@port}")
if @udp if @udp
@udp.close_read rescue nil @udp.close_read rescue nil
@udp.close_write rescue nil @udp.close_write rescue nil
end end
@ -88,10 +84,10 @@ class LogStash::Inputs::Gelf < LogStash::Inputs::Base
@logger.warn("Gelfd failed to parse a message skipping", :exception => ex, :backtrace => ex.backtrace) @logger.warn("Gelfd failed to parse a message skipping", :exception => ex, :backtrace => ex.backtrace)
next next
end end
# Gelfd parser outputs null if it received and cached a non-final chunk # Gelfd parser outputs null if it received and cached a non-final chunk
next if data.nil? next if data.nil?
event = LogStash::Event.new(JSON.parse(data)) event = LogStash::Event.new(JSON.parse(data))
event["source_host"] = client[3] event["source_host"] = client[3]
if event["timestamp"].is_a?(Numeric) if event["timestamp"].is_a?(Numeric)