Class: LogStash::Inputs::Gelf

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/gelf.rb

Overview

This input will read GELF messages as events over the network, making it a good choice if you already use Graylog2 today.

The main use case for this input is to leverage existing GELF logging libraries such as the GELF log4j appender. A library used by this plugin has a bug which prevents it parsing uncompressed data. If you use the log4j appender you need to configure it like this to force gzip even for small messages:

<Socket name="logstash" protocol="udp" host="logstash.example.com" port="5001">
   <GelfLayout compressionType="GZIP" compressionThreshold="1" />
</Socket>

Constant Summary collapse

RECONNECT_BACKOFF_SLEEP = 
5
TIMESTAMP_GELF_FIELD = 
"timestamp".freeze
SOURCE_HOST_FIELD = 
"source_host".freeze
MESSAGE_FIELD = 
"message"
TAGS_FIELD = 
"tags"
PARSE_FAILURE_TAG = 
"_jsonparsefailure"
PARSE_FAILURE_LOG_MESSAGE = 
"JSON parse failure. Falling back to plain-text"

Instance Method Summary collapse

Constructor Details

#initialize(params) ⇒ Gelf

Returns a new instance of Gelf.



63
64
65
66
 
# File 'lib/logstash/inputs/gelf.rb', line 63

def initialize(params)
  super
  BasicSocket.do_not_reverse_lookup = true
end

Instance Method Details

#register ⇒ Object 



69
70
71
 
# File 'lib/logstash/inputs/gelf.rb', line 69

def register
  require 'gelfd'
end

#run(output_queue) ⇒ Object 



74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'lib/logstash/inputs/gelf.rb', line 74

def run(output_queue)
  begin
    # udp server
    udp_listener(output_queue)
  rescue => e
    unless stop?
      @logger.warn("gelf listener died", :exception => e, :backtrace => e.backtrace)
      Stud.stoppable_sleep(RECONNECT_BACKOFF_SLEEP) { stop? }
      retry unless stop?
    end
  end # begin
end

#stop ⇒ Object 



88
89
90
91
 
# File 'lib/logstash/inputs/gelf.rb', line 88

def stop
  @udp.close
rescue IOError # the plugin is currently shutting down, so its safe to ignore theses errors
end