class Fluent::Plugin::OsqueryInput

Public Class Methods

new() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_osquery.rb, line 19
def initialize
  super
end

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_osquery.rb, line 23
def configure(conf)
  super
end
shutdown() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_osquery.rb, line 32
def shutdown
  super
end
start() click to toggle source
Calls superclass method
# File lib/fluent/plugin/in_osquery.rb, line 27
def start
  super
  timer_execute(:in_osquery_timer, interval, &method(:execute))
end

Private Instance Methods

execute() click to toggle source
# File lib/fluent/plugin/in_osquery.rb, line 38
def execute
  @time = Fluent::Engine.now
  cmd = "osqueryi --json \"#{@query}\""
  log.debug(cmd)
  record = `#{cmd}`
  jsonrec = JSON.parse(record)
  jsonrec.each do |line|
    log.debug(line)
    router.emit(@tag, @time, line)
  end
rescue => e
  log.error('faild to run', error: e.to_s, error_class: e.class.to_s)
  log.error_backtrace
end