Class: LogStash::Inputs::Delf

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/delf.rb

Overview

This input will read GELF messages as events over the network, making it a good choice if you already use Graylog2 today.

The main use case for this input is to leverage existing GELF logging libraries such as the GELF log4j appender. A library used by this plugin has a bug which prevents it parsing uncompressed data. If you use the log4j appender you need to configure it like this to force gzip even for small messages:

<Socket name="logstash" protocol="udp" host="logstash.example.com" port="5001">
   <GelfLayout compressionType="GZIP" compressionThreshold="1" />
</Socket>

Constant Summary collapse

RECONNECT_BACKOFF_SLEEP = 
5
TIMESTAMP_GELF_FIELD = 
"timestamp".freeze
SOURCE_HOST_FIELD = 
"source_host".freeze
MESSAGE_FIELD = 
"message"
TAGS_FIELD = 
"tags"
PARSE_FAILURE_TAG = 
"_jsonparsefailure"
PARSE_FAILURE_LOG_MESSAGE = 
"JSON parse failure. Falling back to plain-text"

Instance Method Summary collapse

Constructor Details

#initialize(params) ⇒ Delf

Returns a new instance of Delf.



55
56
57
58
59
 
# File 'lib/logstash/inputs/delf.rb', line 55

def initialize(params)
  super
  BasicSocket.do_not_reverse_lookup = true
  @incomplete_events = {}
end

Instance Method Details

#register ⇒ Object 



62
63
64
 
# File 'lib/logstash/inputs/delf.rb', line 62

def register
  require 'gelfd'
end

#run(output_queue) ⇒ Object 



67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/logstash/inputs/delf.rb', line 67

def run(output_queue)
  begin
    # udp server
    udp_listener(output_queue)
  rescue => e
    unless stop?
      @logger.warn("delf listener died", :exception => e, :backtrace => e.backtrace)
      Stud.stoppable_sleep(RECONNECT_BACKOFF_SLEEP) { stop? }
      retry unless stop?
    end
  end # begin
end

#stop ⇒ Object 



81
82
83
84
 
# File 'lib/logstash/inputs/delf.rb', line 81

def stop
  @udp.close
rescue IOError # the plugin is currently shutting down, so its safe to ignore theses errors
end