class Fluent::Plugin::GCPLMFilter
Public Instance Methods
configure(conf)
click to toggle source
Calls superclass method
# File lib/fluent/plugin/filter_gcplm.rb, line 7 def configure(conf) super # Do the usual configuration here end
filter(tag, time, record)
click to toggle source
# File lib/fluent/plugin/filter_gcplm.rb, line 24 def filter(tag, time, record) message = String.new # The type of service in GCP resourceType = record.dig("resource", "type") resourceMap = Hash.new # The id of project in GCP project_id = record.dig("resource", "labels", "project_id") # The region where the service is running in GCP region = record.dig("resource", "labels", "region") filteredRecord = Hash.new case # Capturing json and text payloads as message field when record['textPayload'] message = record['textPayload'] when record['jsonPayload'] message = record['jsonPayload'].to_json # Capturing the protoPayload when we receive an audit log when record['protoPayload'] message = record['protoPayload'].to_json # for cloudRun we have request logs getting logged when a request is made to the service which has the statusCode, request type etc in httprequest field in the log when record['httpRequest'] && resourceType == 'cloud_run_revision' message = record['httpRequest'].to_json else message = nil end # Mapping the '_lm.resourceId' to the specific resourceId or resourceName depending on the type of service in GCP case resourceType when 'gce_instance' if (record.dig("resource", "labels", "instance_id")) resourceMap = {"system.gcp.resourceid" => record.dig("resource", "labels", "instance_id"), "system.cloud.category" => 'GCP/ComputeEngine'} elsif (record.dig("labels", "compute.googleapis.com/resource_name")) resourceMap = {"system.gcp.resourcename" => record.dig("labels", "compute.googleapis.com/resource_name"), "system.cloud.category" => 'GCP/ComputeEngine'} end when 'cloud_function' resourceMap = {"system.gcp.resourcename" => "projects/" + project_id + "/locations/" + region +"/functions/" + record.dig("resource", "labels", "function_name"), "system.cloud.category" => 'GCP/CloudFunction'} when 'cloudsql_database' resourceMap = {"system.gcp.resourceid" => record.dig("resource", "labels", "database_id"), "system.cloud.category" => 'GCP/CloudSQL'} when 'cloud_run_revision' resourceMap = {"system.gcp.resourcename" => record.dig("resource", "labels", "service_name"), "system.cloud.category" => 'GCP/CloudRun'} when 'cloud_composer_environment' resourceMap = {"system.gcp.resourcename" => "projects/" + project_id + "/locations/" + record.dig("resource", "labels", "location") + "/environments/" + record.dig("resource", "labels", "environment_name"), "system.cloud.category" => 'GCP/CloudComposer'} end if(record.key?("protoPayload") && record.dig('protoPayload', '@type') == "type.googleapis.com/google.cloud.audit.AuditLog") resourceMap = {"system.gcp.projectId" => project_id, "system.cloud.category" => 'GCP/LMAccount'} end # Creating a new record which is further sent to LM filteredRecord['message'] = message filteredRecord['_lm.resourceId'] = resourceMap filteredRecord['timestamp'] = record['timestamp'] filteredRecord end
shutdown()
click to toggle source
This method is called when shutting down. Shutdown the thread and close sockets or files here.
Calls superclass method
# File lib/fluent/plugin/filter_gcplm.rb, line 20 def shutdown super end
start()
click to toggle source
This method is called when starting. Open sockets or files here.
Calls superclass method
# File lib/fluent/plugin/filter_gcplm.rb, line 14 def start super end