Testing

Testing configuration

Running loghub with the argument :

java -jar .../loghub.jar --test|-t -c  .../loghub.conf

Will just parse the configuration for syntax error and then stop.

Testing pattern

Run loghub with the argument :

java -jar .../loghub.jar --grok|-g $PATTERNDIR

It will read the first line of standard input as the grok pattern and will try to match all the following lines against it until interrupted.

For example:

java -jar target/LogHub-0.0.1-SNAPSHOT-jar-with-dependencies.jar --grok src/main/resources/patterns << __EOF__
%{SYSLOG_LINE}
<1>Jan 15 03:24:22 localhost sendmail[46758]: v0F2OMVc046757: to=me@example.com, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=31637, relay=mx.example.com. [169.254.1.1], dsn=2.0.0, stat=Sent (<201701150224.v0F2OM3E025099@host.example.com> [InternalId=177872597] Queued mail for delivery)
__EOF__

will outout on standard output:

{pid=46758, program=sendmail, logsource=localhost, message=v0F2OMVc046757: to=me@example.com, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=31637, relay=mx.example.com. [169.254.1.1], dsn=2.0.0, stat=Sent (<201701150224.v0F2OM3E025099@host.example.com> [InternalId=177872597] Queued mail for delivery), syslog_pri=1, timestamp=Jan 15 03:24:22}

Testing events

Run loghub with the argument :

java -jar .../loghub.jar --pipeline|-p $PIPELINENAME -c  .../loghub.conf

It will read the standard input as a stream of json objects, deserialize as event and send events to the given pipeline.

For example if in you config file there is:

pipeline[syslog] {
    [type] = "syslog"
    | loghub.processors.Grok {
        pattern: "%{SYSLOG_LINE}",
        field: "message",
    }
    | loghub.processors.SyslogPriority {
        field: "syslog_pri",
    }
    | loghub.processors.DateParser {
        fields: [ "timestamp"],
        destination: "@timestamp",
        timezone: "CET",
        success: [timestamp]-
    }
}

One can launch:

java -jar .../loghub.jar --pipeline syslog -c  .../loghub.conf << __EOF__
{
  "message": "<1>Jan 15 03:24:22 localhost sendmail[46758]: v0F2OMVc046757: to=me@example.com, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=31637, relay=mx.example.com. [169.254.1.1], dsn=2.0.0, stat=Sent (<201701150224.v0F2OM3E025099@host.example.com> [InternalId=177872597] Queued mail for delivery)"
}
__EOF__

will output on standard output:

[Jan 15 03:24:22 CET 2017]{pid=46758, program=sendmail, message=v0F2OMVc046757: to=me@example.com, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=31637, relay=mx.example.com. [169.254.1.1], dsn=2.0.0, stat=Sent (<201701150224.v0F2OM3E025099@host.example.com> [InternalId=177872597] Queued mail for delivery), type=ngsyslog, logsource=localhost, syslog_pri={severity=alert, facility=kernel}}