class Fluent::Plugin::SyslogParser

Constants

REGEXP

From existence TextParser pattern

REGEXP_DETECT_RFC5424
REGEXP_RFC5424
REGEXP_WITH_PRI

From in_syslog default pattern

Public Class Methods

new() click to toggle source
Calls superclass method Fluent::Plugin::Base::new
# File lib/fluent/plugin/parser_syslog.rb, line 38
def initialize
  super
  @mutex = Mutex.new
end

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method Fluent::Plugin::Parser#configure
# File lib/fluent/plugin/parser_syslog.rb, line 43
def configure(conf)
  super

  @time_parser_rfc3164 = @time_parser_rfc5424 = nil
  @regexp = case @message_format
            when :rfc3164
              class << self
                alias_method :parse, :parse_plain
              end
              @with_priority ? REGEXP_WITH_PRI : REGEXP
            when :rfc5424
              class << self
                alias_method :parse, :parse_plain
              end
              @time_format = @rfc5424_time_format unless conf.has_key?('time_format')
              REGEXP_RFC5424
            when :auto
              class << self
                alias_method :parse, :parse_auto
              end
              @time_parser_rfc3164 = time_parser_create(format: @time_format)
              @time_parser_rfc5424 = time_parser_create(format: @rfc5424_time_format)
              nil
            end
  @time_parser = time_parser_create
end
parse(text) click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 74
def parse(text)
  # This is overwritten in configure
end
parse_auto(text, &block) click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 78
def parse_auto(text, &block)
  if REGEXP_DETECT_RFC5424.match(text)
    @regexp = REGEXP_RFC5424
    @time_parser = @time_parser_rfc5424
  else
    @regexp = @with_priority ? REGEXP_WITH_PRI : REGEXP
    @time_parser = @time_parser_rfc3164
  end
  parse_plain(text, &block)
end
parse_plain(text) { |nil, nil| ... } click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 89
def parse_plain(text, &block)
  m = @regexp.match(text)
  unless m
    yield nil, nil
    return
  end

  time = nil
  record = {}

  m.names.each { |name|
    if value = m[name]
      case name
      when "pri"
        record['pri'] = value.to_i
      when "time"
        time = @mutex.synchronize { @time_parser.parse(value.gsub(/ +/, ' ')) }
        record[name] = value if @keep_time_key
      else
        record[name] = value
      end
    end
  }

  if @estimate_current_event
    time ||= Fluent::EventTime.now
  end

  yield time, record
end
patterns() click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 70
def patterns
  {'format' => @regexp, 'time_format' => @time_format}
end