class LogStash::Inputs::Gelf
This input will read GELF messages as events over the network, making it a good choice if you already use Graylog2 today.
Constants
- MESSAGE_FIELD
- PARSE_FAILURE_LOG_MESSAGE
- PARSE_FAILURE_TAG
- RECONNECT_BACKOFF_SLEEP
- SOURCE_HOST_FIELD
- TAGS_FIELD
- TIMESTAMP_GELF_FIELD
Public Class Methods
new(params)
click to toggle source
Calls superclass method
# File lib/logstash/inputs/gelf.rb, line 36 def initialize(params) super BasicSocket.do_not_reverse_lookup = true end
Private Class Methods
from_json_parse(json)
click to toggle source
from_json_parse
uses the Event#from_json method to deserialize and directly produce events
# File lib/logstash/inputs/gelf.rb, line 104 def self.from_json_parse(json) # from_json will always return an array of item. # in the context of gelf, the payload should be an array of 1 LogStash::Event.from_json(json).first rescue LogStash::Json::ParserError => e logger.error(PARSE_FAILURE_LOG_MESSAGE, :error => e, :data => json) LogStash::Event.new(MESSAGE_FIELD => json, TAGS_FIELD => [PARSE_FAILURE_TAG, '_fromjsonparser']) end
new_event(json_gelf, host)
click to toggle source
# File lib/logstash/inputs/gelf.rb, line 93 def self.new_event(json_gelf, host) event = parse(json_gelf) return if event.nil? event.set(SOURCE_HOST_FIELD, host) event end
Public Instance Methods
register()
click to toggle source
# File lib/logstash/inputs/gelf.rb, line 42 def register require 'gelfd' end
run(output_queue)
click to toggle source
# File lib/logstash/inputs/gelf.rb, line 47 def run(output_queue) begin # udp server udp_listener(output_queue) rescue => e unless stop? @logger.warn("gelf listener died", :exception => e, :backtrace => e.backtrace) Stud.stoppable_sleep(RECONNECT_BACKOFF_SLEEP) { stop? } retry unless stop? end end # begin end
stop()
click to toggle source
# File lib/logstash/inputs/gelf.rb, line 61 def stop @udp.close rescue IOError # the plugin is currently shutting down, so its safe to ignore theses errors end
Private Instance Methods
udp_listener(output_queue)
click to toggle source
# File lib/logstash/inputs/gelf.rb, line 67 def udp_listener(output_queue) @logger.info("Starting gelf listener", :address => "#{@host}:#{@port}") @udp = UDPSocket.new(Socket::AF_INET) @udp.bind(@host, @port) while !stop? line, client = @udp.recvfrom(8192) begin data = Gelfd::Parser.parse(line) rescue => ex @logger.warn("Gelfd failed to parse a message skipping", :exception => ex, :backtrace => ex.backtrace) next end # Gelfd parser outputs null if it received and cached a non-final chunk next if data.nil? event = self.class.new_event(data, client[3]) next if event.nil? output_queue << event end end