class LogStash::Inputs::Gelf

This input will read GELF messages as events over the network, making it a good choice if you already use Graylog2 today.

Constants

MESSAGE_FIELD
PARSE_FAILURE_LOG_MESSAGE
PARSE_FAILURE_TAG
RECONNECT_BACKOFF_SLEEP
SOURCE_HOST_FIELD
TAGS_FIELD
TIMESTAMP_GELF_FIELD

Public Class Methods

new(params) click to toggle source
Calls superclass method
# File lib/logstash/inputs/gelf.rb, line 36
def initialize(params)
  super
  BasicSocket.do_not_reverse_lookup = true
end

Private Class Methods

from_json_parse(json) click to toggle source

from_json_parse uses the Event#from_json method to deserialize and directly produce events

# File lib/logstash/inputs/gelf.rb, line 104
def self.from_json_parse(json)
  # from_json will always return an array of item.
  # in the context of gelf, the payload should be an array of 1
  LogStash::Event.from_json(json).first
rescue LogStash::Json::ParserError => e
  logger.error(PARSE_FAILURE_LOG_MESSAGE, :error => e, :data => json)
  LogStash::Event.new(MESSAGE_FIELD => json, TAGS_FIELD => [PARSE_FAILURE_TAG, '_fromjsonparser'])
end
new_event(json_gelf, host) click to toggle source
# File lib/logstash/inputs/gelf.rb, line 93
def self.new_event(json_gelf, host)
  event = parse(json_gelf)
  return if event.nil?

  event.set(SOURCE_HOST_FIELD, host)

  event
end

Public Instance Methods

register() click to toggle source
# File lib/logstash/inputs/gelf.rb, line 42
def register
  require 'gelfd'
end
run(output_queue) click to toggle source
# File lib/logstash/inputs/gelf.rb, line 47
def run(output_queue)
  begin
    # udp server
    udp_listener(output_queue)
  rescue => e
    unless stop?
      @logger.warn("gelf listener died", :exception => e, :backtrace => e.backtrace)
      Stud.stoppable_sleep(RECONNECT_BACKOFF_SLEEP) { stop? }
      retry unless stop?
    end
  end # begin
end
stop() click to toggle source
# File lib/logstash/inputs/gelf.rb, line 61
def stop
  @udp.close
rescue IOError # the plugin is currently shutting down, so its safe to ignore theses errors
end

Private Instance Methods

udp_listener(output_queue) click to toggle source
# File lib/logstash/inputs/gelf.rb, line 67
def udp_listener(output_queue)
  @logger.info("Starting gelf listener", :address => "#{@host}:#{@port}")

  @udp = UDPSocket.new(Socket::AF_INET)
  @udp.bind(@host, @port)

  while !stop?
    line, client = @udp.recvfrom(8192)

    begin
      data = Gelfd::Parser.parse(line)
    rescue => ex
      @logger.warn("Gelfd failed to parse a message skipping", :exception => ex, :backtrace => ex.backtrace)
      next
    end

    # Gelfd parser outputs null if it received and cached a non-final chunk
    next if data.nil?

    event = self.class.new_event(data, client[3])
    next if event.nil?

    output_queue << event
  end
end