rpms
/
systemd-journal-gelf
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

We can use a custom separator for structured messages

This commit is contained in:
Daniel Berteaud 2019-03-26 08:38:55 +01:00
parent 8ab6ebb47c
commit 55e826b327
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
systemd-journal-gelf
View File

@ -115,11 +115,19 @@ while ( my $entry = <JOURNAL> ){
level => $msg->{PRIORITY}
};
# Now lets look at the message. If it starts with gelf: we can split it and have further
# fields to send. I use this to handle httpd or nginx logs for example
if ( $msg->{MESSAGE} =~ m/^gelf:([a-zA-Z\d]+=([^\|])\|?)+/ ){
$msg->{MESSAGE} =~ s/^gelf://;
foreach ( split /\|/, $msg->{MESSAGE} ){
# Now lets look at the message. If it starts with gelf: or gelf(<separator>):
# we can split it and have further fields to send.
# I use this to handle httpd or nginx logs for example
# If separator is not specified, the default is | eg
# gelf:code=200|url=/index.html|remote_ip=10.99.5.12|referer=http://test.local/
#
# OR
#
# gelf(~):code=200~url=/index.html~remote_ip=10.99.5.12~referer=http://test.local/
if ( $msg->{MESSAGE} =~ m/^gelf(\([^\(\)]+\))?:([a-zA-Z\d]+=([^\|])\|?)+/ ){
$msg->{MESSAGE} =~ s/^gelf(\([^\(\)]+\))?://;
my $separator = ($1 && length $1 > 0) ? qr{$1} : qr{\|};
foreach ( split /$separator/, $msg->{MESSAGE} ){
my ( $key, $val ) = split /=/, $_;
$gelf->{'_' . lc $key} = $val;
}