class LogStash::Outputs::Syslog

Send events to a syslog server.

You can send messages compliant with RFC3164 or RFC5424 using either UDP or TCP as the transport protocol.

By default the contents of the `message` field will be shipped as the free-form message text part of the emitted syslog message. If your messages don't have a `message` field or if you for some other reason want to change the emitted message, modify the `message` configuration option.

Constants

FACILITY_LABELS
SEVERITY_LABELS

Public Instance Methods

publish(event, payload) click to toggle source
# File lib/logstash/outputs/syslog.rb, line 165
def publish(event, payload)
  appname = event.sprintf(@appname)
  procid = event.sprintf(@procid)
  sourcehost = event.sprintf(@sourcehost)
      tag = event.sprintf(@tag)

  message = payload.to_s.rstrip.gsub(/[\r][\n]/, "\n").gsub(/[\n]/, '\n')
      tags = tag.split(",").map { |value| "tag=\"#{value}\""}.join(" ")

  # fallback to pri 13 (facility 1, severity 5)
  if @use_labels
    facility_code = (FACILITY_LABELS.index(event.sprintf(@facility)) || 1)
    severity_code = (SEVERITY_LABELS.index(event.sprintf(@severity)) || 5)
    priority = (facility_code * 8) + severity_code
  else
    priority = Integer(event.sprintf(@priority)) rescue 13
    priority = 13 if (priority < 0 || priority > 191)
  end

  if @is_rfc3164
    timestamp = event.sprintf("%{+MMM dd HH:mm:ss}")
    syslog_msg = "<#{priority.to_s}>#{timestamp} #{sourcehost} #{appname}[#{procid}]: #{message}"
  else
    msgid = event.sprintf(@msgid)
    timestamp = event.sprintf("%{+YYYY-MM-dd'T'HH:mm:ss.SSSZZ}")
    syslog_msg = "<#{priority.to_s}>1 #{timestamp} #{sourcehost} #{appname} #{procid} #{msgid} [#{key}@#{pen} #{tags}] #{message}"
  end

      counter = 0
  begin
    @client_socket ||= connect
    @client_socket.write(syslog_msg + "\n")
  rescue => e
    # We don't expect udp connections to fail because they are stateless, but ...
    # udp connections may fail/raise an exception if used with localhost/127.0.0.1
    return if udp?
 
    @logger.warn("Attempt - #{counter} syslog " + @protocol + " output exception: closing, reconnecting and resending event", :host => @host, :port => @port, :exception => e, :backtrace => e.backtrace, :event => event)
        @logger.warn("Contents: " )
        @logger.warn("#{syslog_msg}")
        @client_socket.close rescue nil
    @client_socket = nil
        counter = counter + 1
    sleep(@reconnect_interval)
    retry if counter <= retry_count 
  end
end
receive(event) click to toggle source
# File lib/logstash/outputs/syslog.rb, line 161
def receive(event)
  @codec.encode(event)
end
register() click to toggle source
# File lib/logstash/outputs/syslog.rb, line 143
def register
  @client_socket = nil

  if ssl?
    @ssl_context = setup_ssl
  end
  
  if @codec.instance_of? LogStash::Codecs::Plain
    if @codec.config["format"].nil?
      @codec = LogStash::Codecs::Plain.new({"format" => @message})
    end
  end
  @codec.on_event(&method(:publish))

  # use instance variable to avoid string comparison for each event
  @is_rfc3164 = (@rfc == "rfc3164")
end

Private Instance Methods

connect() click to toggle source
# File lib/logstash/outputs/syslog.rb, line 223
def connect
  socket = nil
  if udp?
    socket = UDPSocket.new
    socket.connect(@host, @port)
  else
    socket = TCPSocket.new(@host, @port)
    if ssl?
      socket = OpenSSL::SSL::SSLSocket.new(socket, @ssl_context)
      begin
        socket.connect
      rescue OpenSSL::SSL::SSLError => ssle
        @logger.error("SSL Error", :exception => ssle,
                      :backtrace => ssle.backtrace)
        # NOTE(mrichar1): Hack to prevent hammering peer
        sleep(5)
        raise
      end
    end
  end
  socket
end
setup_ssl() click to toggle source
# File lib/logstash/outputs/syslog.rb, line 246
  def setup_ssl
    require "openssl"
    ssl_context = OpenSSL::SSL::SSLContext.new
    ssl_context.cert = OpenSSL::X509::Certificate.new(File.read(@ssl_cert))
#    ssl_context.key = OpenSSL::PKey::RSA.new(File.read(@ssl_key),@ssl_key_passphrase)
    if @ssl_verify
      cert_store = OpenSSL::X509::Store.new
      # Load the system default certificate path to the store
      cert_store.set_default_paths
      if File.directory?(@ssl_cacert)
        cert_store.add_path(@ssl_cacert)
      else
        cert_store.add_file(@ssl_cacert)
      end
      ssl_context.cert_store = cert_store
      ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER|OpenSSL::SSL::VERIFY_FAIL_IF_NO_PEER_CERT
    end
    ssl_context
  end
ssl?() click to toggle source
# File lib/logstash/outputs/syslog.rb, line 219
def ssl?
  @protocol == "ssl-tcp"
end
udp?() click to toggle source
# File lib/logstash/outputs/syslog.rb, line 215
def udp?
  @protocol == "udp"
end