Skip to content

Commit

Permalink
in_syslog: honor source keys for unmatched lines
Browse files Browse the repository at this point in the history
Include source_address_key or source_hostname_key on unmatched lines
when configured.

This fixes the test cases added in
e3b959b.
  • Loading branch information
aeber committed Aug 12, 2019
1 parent e3b959b commit ecd158d
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions lib/fluent/plugin/in_syslog.rb
Original file line number Diff line number Diff line change
Expand Up @@ -199,14 +199,22 @@ def start_tcp_server(tls: false)

private

def emit_unmatched(data, sock)
record = {}
record[@source_address_key] = sock.remote_addr if @source_address_key
record[@source_hostname_key] = sock.remote_host if @source_hostname_key
record["unmatched_line"] = data
emit("#{@tag}.unmatched", Fluent::EventTime.now, record)
end

def message_handler(data, sock)
pri = nil
text = data
unless @parser_parse_priority
m = SYSLOG_REGEXP.match(data)
unless m
if @emit_unmatched_lines
emit("#{@tag}.unmatched", Fluent::EventTime.now, {"unmatched_line" => data})
emit_unmatched(data, sock)
end
log.warn "invalid syslog message: #{data.dump}"
return
Expand All @@ -218,7 +226,7 @@ def message_handler(data, sock)
@parser.parse(text) do |time, record|
unless time && record
if @emit_unmatched_lines
emit("#{@tag}.unmatched", Fluent::EventTime.now, {"unmatched_line" => text})
emit_unmatched(data, sock)
end
log.warn "failed to parse message", data: data
return
Expand All @@ -238,7 +246,7 @@ def message_handler(data, sock)
end
rescue => e
if @emit_unmatched_lines
emit("#{@tag}.unmatched", Fluent::EventTime.now, {"unmatched_line" => text})
emit_unmatched(data, sock)
end
log.error "invalid input", data: data, error: e
log.error_backtrace
Expand Down

0 comments on commit ecd158d

Please sign in to comment.