Class: LogStash::Inputs::Gelf

Inherits:
Base
  • Object
show all
Defined in:
lib/logstash/inputs/gelf.rb

Overview

This input will read GELF messages as events over the network, making it a good choice if you already use Graylog2 today.

The main use case for this input is to leverage existing GELF logging libraries such as the GELF log4j appender. A library used by this plugin has a bug which prevents it parsing uncompressed data. If you use the log4j appender you need to configure it like this to force gzip even for small messages:

<Socket name="logstash" protocol="udp" host="logstash.example.com" port="5001">
   <GelfLayout compressionType="GZIP" compressionThreshold="1" />
</Socket>

Constant Summary collapse

RECONNECT_BACKOFF_SLEEP = 
5
TIMESTAMP_GELF_FIELD = 
"timestamp".freeze
SOURCE_HOST_FIELD = 
"source_host".freeze
MESSAGE_FIELD = 
"message"
TAGS_FIELD = 
"tags"
PARSE_FAILURE_TAG = 
"_jsonparsefailure"
PARSE_FAILURE_LOG_MESSAGE = 
"JSON parse failure. Falling back to plain-text"

Instance Method Summary collapse

Constructor Details

#initialize(params) ⇒ Gelf 



71
72
73
74
 
# File 'lib/logstash/inputs/gelf.rb', line 71

def initialize(params)
  super
  BasicSocket.do_not_reverse_lookup = true
end

Instance Method Details

#register ⇒ Object 



77
78
79
80
81
 
# File 'lib/logstash/inputs/gelf.rb', line 77

def register
  require 'gelfd'
  @port_tcp ||= @port
  @port_udp ||= @port
end

#run(output_queue) ⇒ Object 



84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/logstash/inputs/gelf.rb', line 84

def run(output_queue)
  begin
    if @use_tcp
      tcp_thr = Thread.new(output_queue) do |output_queue|
        tcp_listener(output_queue)
      end
    end
    if @use_udp
      udp_thr = Thread.new(output_queue) do |output_queue|
        udp_listener(output_queue)
      end
    end
  rescue => e
    unless stop?
      @logger.warn("gelf listener died", :exception => e, :backtrace => e.backtrace)
      Stud.stoppable_sleep(RECONNECT_BACKOFF_SLEEP) { stop? }
      retry unless stop?
    end
  end # begin
  if @use_tcp
    tcp_thr.join
  end
  if @use_udp
    udp_thr.join
  end
end

#stop ⇒ Object 



112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/logstash/inputs/gelf.rb', line 112

def stop
  begin
    @udp.close if @use_udp
  rescue IOError => e
    @logger.warn("Caugh exception while closing udp socket", :exception => e.inspect)
  end
  begin
    @tcp.close if @use_tcp
  rescue IOError => e
    @logger.warn("Caugh exception while closing tcp socket", :exception => e.inspect)
  end
end