class Lumberjack::EcsDevice

This Lumberjack device logs output to another device as JSON formatted text that maps fields to the standard ECS JSON format.

See www.elastic.co/guide/en/ecs/current/ecs-field-reference.html

Constants

ECS_TIMESTAMP_FORMAT

Attributes

backtrace_cleaner[RW]

You can specify a backtrace cleaner that will be called with exception backtraces before they are added to the payload. You can use this to remove superfluous lines, compress line length, etc. One use for it is to keep stack traces clean and prevent them from overflowing the limit on the payload size for an individual log entry.

max_message_length[RW]

You can specify a limit on the message size. Messages over this size will be split into multiple log entries to prevent overflowing the limit on message size which makes the log entries unparseable.

Public Class Methods

new(stream_or_device, backtrace_cleaner: nil, max_message_length: nil, datetime_format: ECS_TIMESTAMP_FORMAT) click to toggle source
Calls superclass method
# File lib/lumberjack_ecs_device.rb, line 141
def initialize(stream_or_device, backtrace_cleaner: nil, max_message_length: nil, datetime_format: ECS_TIMESTAMP_FORMAT)
  super(stream_or_device, mapping: ecs_mapping, datetime_format: datetime_format)
  self.backtrace_cleaner = backtrace_cleaner
  self.max_message_length = max_message_length
  @utc_timestamps = !!datetime_format.match(/[^%]Z/)
end

Public Instance Methods

entry_as_json(entry) click to toggle source
Calls superclass method
# File lib/lumberjack_ecs_device.rb, line 148
def entry_as_json(entry)
  original_time = entry.time
  begin
    entry.time = entry.time.utc if @utc_timestamps && !entry.time.utc?
    super
  ensure
    entry.time = original_time
  end
end

Private Instance Methods

ecs_mapping() click to toggle source
# File lib/lumberjack_ecs_device.rb, line 160
def ecs_mapping
  {
    time: "@timestamp",
    severity: ["log", "level"],
    progname: ["process", "name"],
    pid: ["process", "pid"],
    message: MessageExceptionFormatter.new(self),
    duration: DurationFormatter.new(1_000_000_000),
    duration_ms: DurationFormatter.new(1_000_000),
    duration_micros: DurationFormatter.new(1_000),
    duration_ns: ["event", "duration"],
    tags: EcsTagsFormatter.new(self)
  }
end