class LogStash::Outputs::Syslog
Send events to a syslog server.
You can send messages compliant with RFC3164 or RFC5424 using either UDP or TCP as the transport protocol.
By default the contents of the `message` field will be shipped as the free-form message text part of the emitted syslog message. If your messages don't have a `message` field or if you for some other reason want to change the emitted message, modify the `message` configuration option.
Constants
- FACILITY_LABELS
- SEVERITY_LABELS
Public Instance Methods
publish(event, payload)
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 165 def publish(event, payload) appname = event.sprintf(@appname) procid = event.sprintf(@procid) sourcehost = event.sprintf(@sourcehost) tag = event.sprintf(@tag) message = payload.to_s.rstrip.gsub(/[\r][\n]/, "\n").gsub(/[\n]/, '\n') tags = tag.split(",").map { |value| "tag=\"#{value}\""}.join(" ") # fallback to pri 13 (facility 1, severity 5) if @use_labels facility_code = (FACILITY_LABELS.index(event.sprintf(@facility)) || 1) severity_code = (SEVERITY_LABELS.index(event.sprintf(@severity)) || 5) priority = (facility_code * 8) + severity_code else priority = Integer(event.sprintf(@priority)) rescue 13 priority = 13 if (priority < 0 || priority > 191) end if @is_rfc3164 timestamp = event.sprintf("%{+MMM dd HH:mm:ss}") syslog_msg = "<#{priority.to_s}>#{timestamp} #{sourcehost} #{appname}[#{procid}]: #{message}" else msgid = event.sprintf(@msgid) timestamp = event.sprintf("%{+YYYY-MM-dd'T'HH:mm:ss.SSSZZ}") syslog_msg = "<#{priority.to_s}>1 #{timestamp} #{sourcehost} #{appname} #{procid} #{msgid} [#{key}@#{pen} #{tags}] #{message}" end counter = 0 begin @client_socket ||= connect @client_socket.write(syslog_msg + "\n") rescue => e # We don't expect udp connections to fail because they are stateless, but ... # udp connections may fail/raise an exception if used with localhost/127.0.0.1 return if udp? @logger.warn("Attempt - #{counter} syslog " + @protocol + " output exception: closing, reconnecting and resending event", :host => @host, :port => @port, :exception => e, :backtrace => e.backtrace, :event => event) @logger.warn("Contents: " ) @logger.warn("#{syslog_msg}") @client_socket.close rescue nil @client_socket = nil counter = counter + 1 sleep(@reconnect_interval) retry if counter <= retry_count end end
receive(event)
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 161 def receive(event) @codec.encode(event) end
register()
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 143 def register @client_socket = nil if ssl? @ssl_context = setup_ssl end if @codec.instance_of? LogStash::Codecs::Plain if @codec.config["format"].nil? @codec = LogStash::Codecs::Plain.new({"format" => @message}) end end @codec.on_event(&method(:publish)) # use instance variable to avoid string comparison for each event @is_rfc3164 = (@rfc == "rfc3164") end
Private Instance Methods
connect()
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 223 def connect socket = nil if udp? socket = UDPSocket.new socket.connect(@host, @port) else socket = TCPSocket.new(@host, @port) if ssl? socket = OpenSSL::SSL::SSLSocket.new(socket, @ssl_context) begin socket.connect rescue OpenSSL::SSL::SSLError => ssle @logger.error("SSL Error", :exception => ssle, :backtrace => ssle.backtrace) # NOTE(mrichar1): Hack to prevent hammering peer sleep(5) raise end end end socket end
setup_ssl()
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 246 def setup_ssl require "openssl" ssl_context = OpenSSL::SSL::SSLContext.new ssl_context.cert = OpenSSL::X509::Certificate.new(File.read(@ssl_cert)) # ssl_context.key = OpenSSL::PKey::RSA.new(File.read(@ssl_key),@ssl_key_passphrase) if @ssl_verify cert_store = OpenSSL::X509::Store.new # Load the system default certificate path to the store cert_store.set_default_paths if File.directory?(@ssl_cacert) cert_store.add_path(@ssl_cacert) else cert_store.add_file(@ssl_cacert) end ssl_context.cert_store = cert_store ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT end ssl_context end
ssl?()
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 219 def ssl? @protocol == "ssl-tcp" end
udp?()
click to toggle source
# File lib/logstash/outputs/syslog.rb, line 215 def udp? @protocol == "udp" end