class Fluent::Plugin::SyslogInput

Constants

FACILITY_MAP
PRIORITY_MAP
SYSLOG_REGEXP

Public Class Methods

new() click to toggle source
Calls superclass method Fluent::Compat::Input.new
# File lib/fluent/plugin/in_syslog.rb, line 70
def initialize
  super
  require 'fluent/plugin/socket_util'
end

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method Fluent::PluginLoggerMixin#configure
# File lib/fluent/plugin/in_syslog.rb, line 99
def configure(conf)
  super

  @use_default = false

  if conf.has_key?('format')
    @parser = parser_create(usage: 'syslog_input', type: conf['format'], conf: conf)
  else
    conf['with_priority'] = true
    @parser = parser_create(usage: 'syslog_input', type: 'syslog', conf: conf)
    @use_default = true
  end
  @_event_loop_run_timeout = @blocking_timeout
end
shutdown() click to toggle source
Calls superclass method Fluent::Compat::Input#shutdown
# File lib/fluent/plugin/in_syslog.rb, line 127
def shutdown
  @handler.close

  super
end
start() click to toggle source
Calls superclass method Fluent::Compat::Input#start
# File lib/fluent/plugin/in_syslog.rb, line 114
def start
  super

  callback = if @use_default
               method(:receive_data)
             else
               method(:receive_data_parser)
             end

  @handler = listen(callback)
  event_loop_attach(@handler)
end

Private Instance Methods

emit(pri, time, record) click to toggle source
# File lib/fluent/plugin/in_syslog.rb, line 193
def emit(pri, time, record)
  facility = FACILITY_MAP[pri >> 3]
  priority = PRIORITY_MAP[pri & 0b111]

  tag = "#{@tag}.#{facility}.#{priority}"

  router.emit(tag, time, record)
rescue => e
  log.error "syslog failed to emit", error: e, tag: tag, record: Yajl.dump(record)
end
listen(callback) click to toggle source
# File lib/fluent/plugin/in_syslog.rb, line 176
def listen(callback)
  log.info "listening syslog socket on #{@bind}:#{@port} with #{@protocol_type}"
  socket_manager_path = ENV['SERVERENGINE_SOCKETMANAGER_PATH']
  if Fluent.windows?
    socket_manager_path = socket_manager_path.to_i
  end
  client = ServerEngine::SocketManager::Client.new(socket_manager_path)
  if @protocol_type == :udp
    @usock = client.listen_udp(@bind, @port)
    Fluent::SocketUtil::UdpHandler.new(@usock, log, @message_length_limit, callback)
  else
    # syslog family add "\n" to each message and this seems only way to split messages in tcp stream
    lsock = client.listen_tcp(@bind, @port)
    Coolio::TCPServer.new(lsock, nil, Fluent::SocketUtil::TcpHandler, log, "\n", callback)
  end
end
receive_data(data, addr) click to toggle source
# File lib/fluent/plugin/in_syslog.rb, line 158
def receive_data(data, addr)
  @parser.parse(data) { |time, record|
    unless time && record
      log.warn "invalid syslog message", data: data
      return
    end

    pri = record.delete('pri')
    record[@source_host_key] = addr[2] if @include_source_host
    emit(pri, time, record)
  }
rescue => e
  log.error data.dump, error: e.to_s
  log.error_backtrace
end
receive_data_parser(data, addr) click to toggle source
# File lib/fluent/plugin/in_syslog.rb, line 135
def receive_data_parser(data, addr)
  m = SYSLOG_REGEXP.match(data)
  unless m
    log.warn "invalid syslog message: #{data.dump}"
    return
  end
  pri = m[1].to_i
  text = m[2]

  @parser.parse(text) { |time, record|
    unless time && record
      log.warn "pattern not match: #{text.inspect}"
      return
    end

    record[@source_host_key] = addr[2] if @include_source_host
    emit(pri, time, record)
  }
rescue => e
  log.error data.dump, error: e.to_s
  log.error_backtrace
end