Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new exporter to push JSON to a raw TCP socket #4572

Merged
merged 2 commits into from Aug 15, 2023

Conversation

lingfish
Copy link
Contributor

This is for example useful with Graylog.

Although Graylog has various HTTP inputs, they are for GELF and others, which would need additional formatters on the rspamd side.

Using the raw input results in IO timeouts from the rspamd side, because Graylog's raw input doesn't "speak" HTTP.

This resolves the issue. Combined with an appropriate Graylog pipeline to split into fields, this works well.

Example Graylog pipeline:

rule "JSON to fields"
when
  starts_with(to_string($message.message), "{") && ends_with(to_string($message.message), "}")
then
  let json = parse_json(to_string($message.message));
  let map = to_map(json);
  set_fields(map, "rspamd_");
  set_field("rspamd_score", to_double(map.score));
end

@vstakhov vstakhov merged commit 61d99b6 into rspamd:master Aug 15, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants