class Fluent::Plugin::SyslogParser

Constants

REGEXP

From existence TextParser pattern

REGEXP_DETECT_RFC5424
REGEXP_RFC5424
REGEXP_RFC5424_WITH_PRI
REGEXP_WITH_PRI

From in_syslog default pattern

Public Class Methods

new() click to toggle source
Calls superclass method Fluent::Plugin::Base.new
# File lib/fluent/plugin/parser_syslog.rb, line 42
def initialize
  super
  @mutex = Mutex.new
end

Public Instance Methods

configure(conf) click to toggle source
Calls superclass method Fluent::Plugin::Parser#configure
# File lib/fluent/plugin/parser_syslog.rb, line 47
def configure(conf)
  super

  @time_parser_rfc3164 = @time_parser_rfc5424 = nil
  @time_parser_rfc5424_without_subseconds = nil
  @support_rfc5424_without_subseconds = false
  @regexp = case @message_format
            when :rfc3164
              class << self
                alias_method :parse, :parse_plain
              end
              @with_priority ? REGEXP_WITH_PRI : REGEXP
            when :rfc5424
              class << self
                alias_method :parse, :parse_plain
              end
              @time_format = @rfc5424_time_format unless conf.has_key?('time_format')
              @support_rfc5424_without_subseconds = true
              @with_priority ? REGEXP_RFC5424_WITH_PRI : REGEXP_RFC5424
            when :auto
              class << self
                alias_method :parse, :parse_auto
              end
              @time_parser_rfc3164 = time_parser_create(format: @time_format)
              @time_parser_rfc5424 = time_parser_create(format: @rfc5424_time_format)
              nil
            end
  @time_parser = time_parser_create
  @time_parser_rfc5424_without_subseconds = time_parser_create(format: "%Y-%m-%dT%H:%M:%S%z")
end
parse(text) click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 82
def parse(text)
  # This is overwritten in configure
end
parse_auto(text, &block) click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 86
def parse_auto(text, &block)
  if REGEXP_DETECT_RFC5424.match(text)
    @regexp = @with_priority ? REGEXP_RFC5424_WITH_PRI : REGEXP_RFC5424
    @time_parser = @time_parser_rfc5424
    @support_rfc5424_without_subseconds = true
  else
    @regexp = @with_priority ? REGEXP_WITH_PRI : REGEXP
    @time_parser = @time_parser_rfc3164
  end
  parse_plain(text, &block)
end
parse_plain(text) { |nil, nil| ... } click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 98
def parse_plain(text, &block)
  m = @regexp.match(text)
  unless m
    yield nil, nil
    return
  end

  time = nil
  record = {}

  m.names.each { |name|
    if value = m[name]
      case name
      when "pri"
        record['pri'] = value.to_i
      when "time"
        time = @mutex.synchronize do
          time_str = value.squeeze(' ')
          begin
            @time_parser.parse(time_str)
          rescue Fluent::TimeParser::TimeParseError => e
            if @support_rfc5424_without_subseconds
              log.trace(e)
              @time_parser_rfc5424_without_subseconds.parse(time_str)
            else
              raise
            end
          end
        end
        record[name] = value if @keep_time_key
      else
        record[name] = value
      end
    end
  }

  if @estimate_current_event
    time ||= Fluent::EventTime.now
  end

  yield time, record
end
patterns() click to toggle source
# File lib/fluent/plugin/parser_syslog.rb, line 78
def patterns
  {'format' => @regexp, 'time_format' => @time_format}
end