Documentation
¶
Index ¶
- Variables
- func MapStrFromJournalEntry(ev sdjournal.JournalEntry, cleanKeys bool, convertToNumbers bool) common.MapStr
- func MapStrMoveJournalMetadata(in common.MapStr, location string) common.MapStr
- func MapStrMoveMapToLocation(in common.MapStr, location string) common.MapStr
- func Publish(beat *beat.Beat, jb *Journalbeat)
- func WriteCursorLoop(jb *Journalbeat)
- type ConfigSettings
- type JournalReaderConfig
- type Journalbeat
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func MapStrFromJournalEntry ¶
func MapStrFromJournalEntry(ev sdjournal.JournalEntry, cleanKeys bool, convertToNumbers bool) common.MapStr
MapStrFromJournalEntry takes a JournalD entry and converts it to an event that is more compatible with the Elasitc products. It will perform the following additional steps to an event:
- add "@timestamp" field from either _SOURCE_REALTIME_TIMESTAMP, __REALTIME_TIMESTAMP or time.Now() (in that order depending on success)
- lowercase all fields (seriously, who wants to type caps all day?!?)
- remove underscores from the beginning of fields as they are reserved in ElasticSearch for metadata information
- fields that can be converted to numbers, will be converted to numbers
func MapStrMoveJournalMetadata ¶
MapStrMoveJournalMetadata will create a separate map for the Journal metadata and move all fields except "message" and "@timestamp" to the separate map which will be available at key "location"
func MapStrMoveMapToLocation ¶
func Publish ¶
func Publish(beat *beat.Beat, jb *Journalbeat)
Publish is used to publish read events to the beat output chain
func WriteCursorLoop ¶
func WriteCursorLoop(jb *Journalbeat)
WriteCursorLoop runs the loop which flushes the current cursor position to a file
Types ¶
type ConfigSettings ¶
type ConfigSettings struct {
Input JournalReaderConfig `config:"input"`
}
ConfigSettings holds JournalConfig at the Input section of the config file
type JournalReaderConfig ¶
type JournalReaderConfig struct {
WriteCursorState *bool `config:"write_cursor_state"`
CursorStateFile *string `config:"cursor_state_file"`
FlushCursorSecs *int `config:"flush_cursor_secs"`
SeekPosition *string `config:"seek_position"`
CursorSeekFallback *string `config:"cursor_seek_fallback"`
ConvertToNumbers *bool `config:"convert_to_numbers"`
CleanFieldNames *bool `config:"clean_field_names"`
MoveMetadataLocation *string `config:"move_metadata_to_field"`
FieldsDest *string `config:"fields_dest"`
Fields *common.MapStr `config:"fields"`
}
JournalReaderConfig provides the config settings for the journald reader
type Journalbeat ¶
type Journalbeat struct {
JbConfig ConfigSettings
// contains filtered or unexported fields
}
Journalbeat is the main Journalbeat struct
func New ¶
func New() *Journalbeat
New creates a new Journalbeat object and returns. Should be done once in main
func (*Journalbeat) Cleanup ¶
func (jb *Journalbeat) Cleanup(b *beat.Beat) error
Cleanup cleans up resources
func (*Journalbeat) Config ¶
func (jb *Journalbeat) Config(b *beat.Beat) error
Config parses configuration data and prepares for Setup
func (*Journalbeat) Run ¶
func (jb *Journalbeat) Run(b *beat.Beat) error
Run is the main event loop: read from journald and pass it to Publish
Source Files