/
hook.go
310 lines (265 loc) · 7.37 KB
/
hook.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
// Use of this source code is governed by the MIT
// license that can be found in the LICENSE file.
// inspired from github.com/gemnasium/logrus-graylog-hook
package hook
import (
"context"
"crypto/tls"
"fmt"
"os"
"strings"
"time"
"github.com/eapache/go-resiliency/retrier"
"github.com/sirupsen/logrus"
)
type Priority int
const (
// Severity.
// From /usr/include/sys/syslog.h.
// These are the same on Linux, BSD, and OS X.
LOG_EMERG Priority = iota
LOG_ALERT
LOG_CRIT
LOG_ERR
LOG_WARNING
LOG_NOTICE
LOG_INFO
LOG_DEBUG
)
// priorities maps logrus log levels to syslog severity
var priorities = map[logrus.Level]Priority{
logrus.PanicLevel: LOG_ALERT,
logrus.FatalLevel: LOG_CRIT,
logrus.ErrorLevel: LOG_ERR,
logrus.WarnLevel: LOG_WARNING,
logrus.InfoLevel: LOG_INFO,
logrus.DebugLevel: LOG_DEBUG,
}
// MergeFields defines a function to merge fields. It used for example to define your own field
// convientions to match with your graylog service.
type MergeFields func(...map[string]interface{}) map[string]interface{}
// Set graylog.BufSize = <value> _before_ calling NewHook
// Once the buffer is full, logging will start blocking, waiting for slots to
// be available in the queue.
var BufSize uint = 16384
// Config is the required configuration for creating a Graylog hook
type Config struct {
Addr string
Protocol string
Hostname string
Facility string
TLSConfig *tls.Config
Merge func(...map[string]interface{}) map[string]interface{}
ThrottlePolicy *ThrottlePolicyConfig
}
// Hook to send logs to a logging service compatible with the Graylog API and the GELF format.
type Hook struct {
Facility string
Hostname string
// Extra fields to send to Graylog for each log entry.
Extra map[string]interface{}
// Minimum logging level to send to Graylog.
// Must be set before adding to logrus logger.
// Default is logrus.InfoLevel.
Threshold logrus.Level
merge MergeFields
Pid int
gelfLogger Writer
throttleStack *Stack
throttleTicker *time.Ticker
throttlePolicy ThrottlePolicy
stopChan chan bool
}
// NewHook creates a hook to be added to an instance of logger.
func NewHook(ctx context.Context, cfg *Config, extra map[string]interface{}) (*Hook, error) {
// Get a hostname if not set
hostname := cfg.Hostname
if hostname == "" {
if h, err := os.Hostname(); err == nil {
if i := strings.Index(h, "."); i >= 0 {
h = h[:i]
}
hostname = h
}
}
// Get protocol
protocol := cfg.Protocol
if protocol == "" {
protocol = "tcp"
}
// Join host and port
var w Writer
var err error
switch protocol {
case "tcp":
w, err = NewTCPWriter(cfg.Addr, cfg.TLSConfig)
case "udp":
w, err = NewUDPWriter(cfg.Addr)
default:
err = fmt.Errorf("unknown protocol %q", protocol)
}
if err != nil {
return nil, err
}
merge := mergeFields
if cfg.Merge != nil {
merge = cfg.Merge
}
hook := &Hook{
Facility: cfg.Facility,
Hostname: hostname,
Extra: extra,
Threshold: logrus.DebugLevel,
merge: merge,
Pid: os.Getpid(),
gelfLogger: w,
stopChan: make(chan bool),
}
if cfg.ThrottlePolicy == nil {
dfault := NewDefaultThrottlePolicy()
cfg.ThrottlePolicy = &ThrottlePolicyConfig{
Amount: 5,
Period: 10 * time.Second,
Policy: dfault,
}
}
hook.throttleStack = NewStack(cfg.ThrottlePolicy.Amount)
hook.throttleTicker = time.NewTicker(cfg.ThrottlePolicy.Period)
hook.throttlePolicy = cfg.ThrottlePolicy.Policy
hook.throttlePolicy.Init(hook)
fmt.Fprintf(os.Stdout, "[graylog] using endpoint: %s\n", cfg.Addr)
go hook.fire() // Log in background
go func() {
select {
case <-ctx.Done():
hook.Flush()
case <-hook.stopChan:
return
}
}()
return hook, nil
}
func (hook *Hook) Stop() {
if hook.stopChan != nil {
hook.stopChan <- true
close(hook.stopChan)
hook.stopChan = nil
}
}
// Fire is called when a log event is fired.
// We assume the entry will be altered by another hook,
// otherwise we might logging something wrong to Graylog
func (hook *Hook) Fire(entry *logrus.Entry) error {
// get caller file and line here, it won't be available inside the goroutine
// 1 for the function that called us.
// we also make most of the work out of the lock scope to reduce
// performance impact due to locking
file, line := getCallerIgnoringLogMulti(1)
msg := hook.messageFromEntry(entry, file, line)
return hook.FireMessage(*msg)
}
type FireMessageFunc func(msg Message) error
func (hook *Hook) IsThrottled() bool {
return !hook.throttleStack.Empty()
}
func (hook *Hook) FireMessage(msg Message) error {
switch {
case !hook.IsThrottled() && !hook.throttlePolicy.PendingTrailingMessages():
hook.throttleStack.Push(msg)
default:
hook.throttlePolicy.HandleTrailingMessage(msg)
}
return nil
}
func (hook *Hook) Flush() {
hook.throttlePolicy.Flush()
}
var r = retrier.New(retrier.ExponentialBackoff(20, time.Millisecond), nil)
func (hook *Hook) send(m Message) {
// we retry at least 3 times to write message to graylog.
err := r.Run(func() error {
if err := hook.gelfLogger.WriteMessage(&m); err != nil {
fmt.Fprintln(os.Stderr, "[graylog] could not write message to Graylog:", err)
return err
}
return nil
})
// if after all the retries we still cannot write the message, just skip
if err != nil {
fmt.Fprintln(os.Stderr, "[graylog] could not write message to Graylog after several retries:", err)
}
}
// fire will loop on the 'throttled' channel, and write entries to graylog
func (hook *Hook) fire() {
defer hook.throttleTicker.Stop()
for range hook.throttleTicker.C {
for {
time.Sleep(time.Millisecond)
m, has := hook.throttleStack.Pop()
if !has {
continue
}
hook.send(m)
}
}
}
// Levels returns the available logging levels.
func (hook *Hook) Levels() []logrus.Level {
levels := make([]logrus.Level, 0, hook.Threshold)
for l := logrus.PanicLevel; l <= hook.Threshold; l++ {
levels = append(levels, l)
}
return levels
}
func (hook *Hook) messageFromEntry(entry *logrus.Entry, file string, line int) *Message {
p := entry.Message
// If there are newlines in the message, use the first line
// for the short message and set the full message to the
// original input. If the input has no newlines, stick the
// whole thing in Short.
short := p
full := p
if i := strings.IndexRune(p, '\n'); i > 0 {
short = p[:i]
full = p
}
// Merge hook extra fields and entry fields
extra := hook.merge(hook.Extra, entry.Data)
return &Message{
Version: "1.1",
Host: hook.Hostname,
Short: short,
Full: full,
Time: float64(entry.Time.UnixNano()) / 1e9,
Level: int32(priorities[entry.Level]),
Pid: hook.Pid,
Facility: hook.Facility,
File: file,
Line: line,
Extra: extra,
}
}
func mergeFields(extraFields ...map[string]interface{}) map[string]interface{} {
mergedFields := make(map[string]interface{})
for _, fields := range extraFields {
for fieldName, value := range fields {
// skip id if present
if fieldName == "id" {
continue
}
// otherwise convert if necessary
switch value.(type) {
// if string or number
case string, int, int8, int16, int32, int64,
uint, uint8, uint16, uint32, uint64,
float32, float64:
mergedFields["_"+fieldName] = value
case time.Time:
mergedFields["_"+fieldName] = value.(time.Time).Format(time.RFC3339)
default:
mergedFields["_"+fieldName] = fmt.Sprintf("%v", value)
}
}
}
return mergedFields
}