beat

Documentation

Index

• Variables
• func MapStrFromJournalEntry(ev sdjournal.JournalEntry, cleanKeys bool, convertToNumbers bool) common.MapStr
• func MapStrMoveJournalMetadata(in common.MapStr, location string) common.MapStr
• func MapStrMoveMapToLocation(in common.MapStr, location string) common.MapStr
• func Publish(beat *beat.Beat, jb *Journalbeat)
• func WriteCursorLoop(jb *Journalbeat)
• type ConfigSettings
• type JournalReaderConfig
• type Journalbeat
  • func New() *Journalbeat
  • func (jb *Journalbeat) Cleanup(b *beat.Beat) error
  • func (jb *Journalbeat) Config(b *beat.Beat) error
  • func (jb *Journalbeat) Run(b *beat.Beat) error
  • func (jb *Journalbeat) Setup(b *beat.Beat) error
  • func (jb *Journalbeat) Stop()

Variables

var SeekFallbackPositions = map[string]bool{
	"none": true,
	"head": true,
	"tail": true,
}

var SeekPositions = map[string]bool{
	"cursor": true,
	"head":   true,
	"tail":   true,
}

Functions

func MapStrFromJournalEntry

func MapStrFromJournalEntry(ev sdjournal.JournalEntry, cleanKeys bool, convertToNumbers bool) common.MapStr

MapStrFromJournalEntry takes a JournalD entry and converts it to an event that is more compatible with the Elasitc products. It will perform the following additional steps to an event:

• add "@timestamp" field from either _SOURCE_REALTIME_TIMESTAMP, __REALTIME_TIMESTAMP or time.Now() (in that order depending on success)
• lowercase all fields (seriously, who wants to type caps all day?!?)
• remove underscores from the beginning of fields as they are reserved in ElasticSearch for metadata information
• fields that can be converted to numbers, will be converted to numbers

func MapStrMoveJournalMetadata

func MapStrMoveJournalMetadata(in common.MapStr, location string) common.MapStr

MapStrMoveJournalMetadata will create a separate map for the Journal metadata and move all fields except "message" and "@timestamp" to the separate map which will be available at key "location"

func MapStrMoveMapToLocation

func MapStrMoveMapToLocation(in common.MapStr, location string) common.MapStr

func Publish

func Publish(beat *beat.Beat, jb *Journalbeat)

Publish is used to publish read events to the beat output chain

func WriteCursorLoop

func WriteCursorLoop(jb *Journalbeat)

WriteCursorLoop runs the loop which flushes the current cursor position to a file

Types

type ConfigSettings

type ConfigSettings struct {
	Input JournalReaderConfig `config:"input"`
}

ConfigSettings holds JournalConfig at the Input section of the config file

type JournalReaderConfig

type JournalReaderConfig struct {
	WriteCursorState     *bool          `config:"write_cursor_state"`
	CursorStateFile      *string        `config:"cursor_state_file"`
	FlushCursorSecs      *int           `config:"flush_cursor_secs"`
	SeekPosition         *string        `config:"seek_position"`
	CursorSeekFallback   *string        `config:"cursor_seek_fallback"`
	ConvertToNumbers     *bool          `config:"convert_to_numbers"`
	CleanFieldNames      *bool          `config:"clean_field_names"`
	MoveMetadataLocation *string        `config:"move_metadata_to_field"`
	FieldsDest           *string        `config:"fields_dest"`
	Fields               *common.MapStr `config:"fields"`
}

JournalReaderConfig provides the config settings for the journald reader

type Journalbeat

type Journalbeat struct {
	JbConfig ConfigSettings
	// contains filtered or unexported fields
}

Journalbeat is the main Journalbeat struct

func New

func New() *Journalbeat

New creates a new Journalbeat object and returns. Should be done once in main

func (*Journalbeat) Cleanup

func (jb *Journalbeat) Cleanup(b *beat.Beat) error

Cleanup cleans up resources

func (*Journalbeat) Config

func (jb *Journalbeat) Config(b *beat.Beat) error

Config parses configuration data and prepares for Setup

func (*Journalbeat) Run

func (jb *Journalbeat) Run(b *beat.Beat) error

Run is the main event loop: read from journald and pass it to Publish

func (*Journalbeat) Setup

func (jb *Journalbeat) Setup(b *beat.Beat) error

Setup prepares Journalbeat for the main loop (starts journalreader, etc.)

func (*Journalbeat) Stop

func (jb *Journalbeat) Stop()

Stop stops the journalbeat