class Lumberjack::EcsDevice
This Lumberjack
device logs output to another device as JSON formatted text that maps fields to the standard ECS JSON format.
See www.elastic.co/guide/en/ecs/current/ecs-field-reference.html
Constants
- ECS_TIMESTAMP_FORMAT
Attributes
backtrace_cleaner[RW]
You can specify a backtrace cleaner that will be called with exception backtraces before they are added to the payload. You can use this to remove superfluous lines, compress line length, etc. One use for it is to keep stack traces clean and prevent them from overflowing the limit on the payload size for an individual log entry.
max_message_length[RW]
You can specify a limit on the message size. Messages over this size will be split into multiple log entries to prevent overflowing the limit on message size which makes the log entries unparseable.
Public Class Methods
new(stream_or_device, backtrace_cleaner: nil, max_message_length: nil, datetime_format: ECS_TIMESTAMP_FORMAT)
click to toggle source
Calls superclass method
# File lib/lumberjack_ecs_device.rb, line 141 def initialize(stream_or_device, backtrace_cleaner: nil, max_message_length: nil, datetime_format: ECS_TIMESTAMP_FORMAT) super(stream_or_device, mapping: ecs_mapping, datetime_format: datetime_format) self.backtrace_cleaner = backtrace_cleaner self.max_message_length = max_message_length @utc_timestamps = !!datetime_format.match(/[^%]Z/) end
Public Instance Methods
entry_as_json(entry)
click to toggle source
Calls superclass method
# File lib/lumberjack_ecs_device.rb, line 148 def entry_as_json(entry) original_time = entry.time begin entry.time = entry.time.utc if @utc_timestamps && !entry.time.utc? super ensure entry.time = original_time end end
Private Instance Methods
ecs_mapping()
click to toggle source
# File lib/lumberjack_ecs_device.rb, line 160 def ecs_mapping { time: "@timestamp", severity: ["log", "level"], progname: ["process", "name"], pid: ["process", "pid"], message: MessageExceptionFormatter.new(self), duration: DurationFormatter.new(1_000_000_000), duration_ms: DurationFormatter.new(1_000_000), duration_micros: DurationFormatter.new(1_000), duration_ns: ["event", "duration"], tags: EcsTagsFormatter.new(self) } end