input

Documentation

Index

• Constants
• func ValidFormat(format string) bool
• type Collector
  • func NewCollector(proto, iface, format string, tlsConfig *tls.Config) (Collector, error)
• type Event
  • func NewEvent() *Event
  • func (e *Event) ReferenceTime() time.Time
• type NetstrDelimiter
  • func NewNetstrDelimiter() *NetstrDelimiter
  • func (d *NetstrDelimiter) Push(b byte) (bool, error)
  • func (d *NetstrDelimiter) Reset()
• type Parser
  • func NewParser(f string) (*Parser, error)
  • func (p *Parser) Parse(b []byte) bool
• type RFC5424
• type SyslogDelimiter
  • func NewSyslogDelimiter(maxSize int) *SyslogDelimiter
  • func (s *SyslogDelimiter) Push(b byte) (string, bool)
  • func (s *SyslogDelimiter) Vestige() (string, bool)
• type TCPCollector
  • func (s *TCPCollector) Addr() net.Addr
  • func (s *TCPCollector) Start(c chan<- *Event) error
• type UDPCollector
  • func (s *UDPCollector) Addr() net.Addr
  • func (s *UDPCollector) Start(c chan<- *Event) error

Constants

const (
	// SYSLOG_DELIMITER indicates the start of a syslog line
	SYSLOG_DELIMITER = `<[0-9]{1,3}>[0-9]\s`
)

Functions

func ValidFormat

func ValidFormat(format string) bool

ValidFormat returns if the given format matches one of the possible formats.

Types

type Collector

type Collector interface {
	Start(chan<- *Event) error
	Addr() net.Addr
}

Collector specifies the interface all network collectors must implement.

func NewCollector

func NewCollector(proto, iface, format string, tlsConfig *tls.Config) (Collector, error)

NewCollector returns a network collector of the specified type, that will bind to the given inteface on Start(). If config is non-nil, a secure Collector will be returned. Secure Collectors require the protocol be TCP.

type Event

type Event struct {
	Text          string                 // Delimited log line
	Parsed        map[string]interface{} // If non-nil, contains parsed fields
	ReceptionTime time.Time              // Time log line was received
	Sequence      int64                  // Provides order of reception
	SourceIP      string                 // Sender's IP address
	// contains filtered or unexported fields
}

Event is a log message, with a reception timestamp and sequence number.

func NewEvent

func NewEvent() *Event

NewEvent returns a new Event.

func (*Event) ReferenceTime

func (e *Event) ReferenceTime() time.Time

ReferenceTime returns the reference time of an event.

type NetstrDelimiter

type NetstrDelimiter struct {
	Result string
	// contains filtered or unexported fields
}

A NetstrDelimiter detects when message lines start.

func NewNetstrDelimiter

func NewNetstrDelimiter() *NetstrDelimiter

NewNetstrDelimiter returns an initialized NetstrDelimiter.

func (*NetstrDelimiter) Push

func (d *NetstrDelimiter) Push(b byte) (bool, error)

Push the given byte into a buffer, return when a new result is available, as well as the first occurring error (if any occurred).

func (*NetstrDelimiter) Reset

func (d *NetstrDelimiter) Reset()

Reset the NetstrDelimiter instance to its initial state.

type Parser

type Parser struct {
	Raw    []byte
	Result map[string]interface{}
	// contains filtered or unexported fields
}

A Parser parses the raw input as a map with a timestamp field.

func NewParser

func NewParser(f string) (*Parser, error)

NewParser returns a new Parser instance.

func (*Parser) Parse

func (p *Parser) Parse(b []byte) bool

Parse the given byte slice.

type RFC5424

type RFC5424 struct {
	// contains filtered or unexported fields
}

RFC5424 represents a parser for RFC5424-compliant log messages

type SyslogDelimiter

type SyslogDelimiter struct {
	// contains filtered or unexported fields
}

A SyslogDelimiter detects when Syslog lines start.

func NewSyslogDelimiter

func NewSyslogDelimiter(maxSize int) *SyslogDelimiter

NewSyslogDelimiter returns an initialized SyslogDelimiter.

func (*SyslogDelimiter) Push

func (s *SyslogDelimiter) Push(b byte) (string, bool)

Push a byte into the SyslogDelimiter. If the byte results in a a new Syslog message, it'll be flagged via the bool.

func (*SyslogDelimiter) Vestige

func (s *SyslogDelimiter) Vestige() (string, bool)

Vestige returns the bytes which have been pushed to SyslogDelimiter, since the last Syslog message was returned, but only if the buffer appears to be a valid syslog message.

type TCPCollector

type TCPCollector struct {
	// contains filtered or unexported fields
}

TCPCollector represents a network collector that accepts and handler TCP connections.

func (*TCPCollector) Addr

func (s *TCPCollector) Addr() net.Addr

Addr returns the net.Addr that the Collector is bound to, in a race-say manner.

func (*TCPCollector) Start

func (s *TCPCollector) Start(c chan<- *Event) error

Start instructs the TCPCollector to bind to the interface and accept connections.

type UDPCollector

type UDPCollector struct {
	// contains filtered or unexported fields
}

UDPCollector represents a network collector that accepts UDP packets.

func (*UDPCollector) Addr

func (s *UDPCollector) Addr() net.Addr

Addr returns the net.Addr to which the UDP collector is bound.

func (*UDPCollector) Start

func (s *UDPCollector) Start(c chan<- *Event) error

Start instructs the UDPCollector to start reading packets from the interface.