beater

Documentation

Index

• func MapStrFromJournalEntry(ev *sdjournal.JournalEntry, cleanKeys bool, convertToNumbers bool, ...) common.MapStr
• func New(b *beat.Beat, cfg *common.Config) (beat.Beater, error)
• type Journalbeat
  • func (jb *Journalbeat) Run(b *beat.Beat) error
  • func (jb *Journalbeat) Stop()

Functions

func MapStrFromJournalEntry

func MapStrFromJournalEntry(ev *sdjournal.JournalEntry, cleanKeys bool, convertToNumbers bool, MoveMetadataLocation string) common.MapStr

MapStrFromJournalEntry takes a JournalD entry and converts it to an event that is more compatible with the Elasitc products. It will perform the following additional steps to an event:

• lowercase all fields (seriously, who wants to type caps all day?!?)
• remove underscores from the beginning of fields as they are reserved in ElasticSearch for metadata information
• fields that can be converted to numbers, will be converted to numbers

func New

func New(b *beat.Beat, cfg *common.Config) (beat.Beater, error)

New creates beater

Types

type Journalbeat

type Journalbeat struct {
	// contains filtered or unexported fields
}

Journalbeat is the main Journalbeat struct

func (*Journalbeat) Run

func (jb *Journalbeat) Run(b *beat.Beat) error

Run is the main event loop: read from journald and pass it to Publish

func (*Journalbeat) Stop

func (jb *Journalbeat) Stop()

Stop stops Journalbeat execution