gelf

README

Elasticsearch output

It sends event batches to the GELF endpoint. Transport level protocol TCP or UDP is configurable.

It doesn't support UDP chunking. So don't use UDP if event size may be greater than 8192.

GELF messages are separated by null byte. Each message is a JSON with the following fields:

• version string=1.1
• host string
• short_message string
• full_message string
• timestamp number
• level number
• _extra_field_1 string
• _extra_field_2 string
• _extra_field_3 string

Every field with an underscore prefix _ will be treated as an extra field. Allowed characters in field names are letters, numbers, underscores, dashes, and dots.

Config params

endpoint string required

An address of gelf endpoint. Format: HOST:PORT. E.g. localhost:12201.

reconnect_interval cfg.Duration default=1m

The plugin reconnects to endpoint periodically using this interval. It is useful if an endpoint is a load balancer.

connection_timeout cfg.Duration default=5s

How much time to wait for the connection?

host_field string default=host

Which field of the event should be used as host GELF field.

short_message_field string default=message

Which field of the event should be used as short_message GELF field.

default_short_message_value string default=not set

The default value for short_message GELF field if nothing is found in the event.

full_message_field string

Which field of the event should be used as full_message GELF field.

timestamp_field string default=time

Which field of the event should be used as timestamp GELF field.

timestamp_field_format string default=rfc3339nano options=ansic|unixdate|rubydate|rfc822|rfc822z|rfc850|rfc1123|rfc1123z|rfc3339|rfc3339nano|kitchen|stamp|stampmilli|stampmicro|stampnano

In which format timestamp field should be parsed.

level_field string default=level

Which field of the event should be used as a level GELF field. Level field should contain level number or string according to RFC 5424:

• 7 or debug
• 6 or info
• 5 or notice
• 4 or warning
• 3 or error
• 2 or critical
• 1 or alert
• 0 or emergency

Otherwise 6 will be used.

workers_count cfg.Expression default=gomaxprocs*4

How many workers will be instantiated to send batches.

batch_size cfg.Expression default=capacity/4

A maximum quantity of events to pack into one batch.

batch_flush_timeout cfg.Duration default=200ms

After this timeout the batch will be sent even if batch isn't completed.

Generated using insane-doc

Documentation

Index

• func Factory() (pipeline.AnyPlugin, pipeline.AnyConfig)
• type Config
• type Plugin
  • func (p *Plugin) Out(event *pipeline.Event)
  • func (p *Plugin) Start(config pipeline.AnyConfig, params *pipeline.OutputPluginParams)
  • func (p *Plugin) Stop()

Functions

func Factory

func Factory() (pipeline.AnyPlugin, pipeline.AnyConfig)

Types

type Config

type Config struct {
	//> @3@4@5@6
	//>
	//> An address of gelf endpoint. Format: `HOST:PORT`. E.g. `localhost:12201`.
	Endpoint string `json:"endpoint" required:"true"` //*

	//> @3@4@5@6
	//>
	//> The plugin reconnects to endpoint periodically using this interval. It is useful if an endpoint is a load balancer.
	ReconnectInterval  cfg.Duration `json:"reconnect_interval" default:"1m" parse:"duration"` //*
	ReconnectInterval_ time.Duration

	//> @3@4@5@6
	//>
	//> How much time to wait for the connection?
	ConnectionTimeout  cfg.Duration `json:"connection_timeout" default:"5s" parse:"duration"` //*
	ConnectionTimeout_ time.Duration

	//> @3@4@5@6
	//>
	//> Which field of the event should be used as `host` GELF field.
	HostField string `json:"host_field" default:"host"` //*

	//> @3@4@5@6
	//>
	//>  Which field of the event should be used as `short_message` GELF field.
	ShortMessageField string `json:"short_message_field" default:"message"` //*

	//> @3@4@5@6
	//>
	//>  The default value for `short_message` GELF field if nothing is found in the event.
	DefaultShortMessageValue string `json:"default_short_message_value" default:"not set"` //*

	//> @3@4@5@6
	//>
	//> Which field of the event should be used as `full_message` GELF field.
	FullMessageField string `json:"full_message_field" default:""` //*

	//> @3@4@5@6
	//>
	//> Which field of the event should be used as `timestamp` GELF field.
	TimestampField string `json:"timestamp_field" default:"time"` //*

	//> @3@4@5@6
	//>
	//> In which format timestamp field should be parsed.
	TimestampFieldFormat string `` //*
	/* 190-byte string literal not displayed */

	//> @3@4@5@6
	//>
	//> Which field of the event should be used as a `level` GELF field. Level field should contain level number or string according to RFC 5424:
	//> * `7` or `debug`
	//> * `6` or `info`
	//> * `5` or `notice`
	//> * `4` or `warning`
	//> * `3` or `error`
	//> * `2` or `critical`
	//> * `1` or `alert`
	//> * `0` or `emergency`
	//>
	//> Otherwise `6` will be used.
	LevelField string `json:"level_field" default:"level"` //*

	//> @3@4@5@6
	//>
	//> How many workers will be instantiated to send batches.
	WorkersCount  cfg.Expression `json:"workers_count" default:"gomaxprocs*4" parse:"expression"` //*
	WorkersCount_ int

	//> @3@4@5@6
	//>
	//> A maximum quantity of events to pack into one batch.
	BatchSize  cfg.Expression `json:"batch_size" default:"capacity/4" parse:"expression"` //*
	BatchSize_ int

	//> @3@4@5@6
	//>
	//> After this timeout the batch will be sent even if batch isn't completed.
	BatchFlushTimeout  cfg.Duration `json:"batch_flush_timeout" default:"200ms" parse:"duration"` //*
	BatchFlushTimeout_ time.Duration
	// contains filtered or unexported fields
}

! config-params ^ config-params

type Plugin

type Plugin struct {
	// contains filtered or unexported fields
}

func (*Plugin) Out

func (p *Plugin) Out(event *pipeline.Event)

func (*Plugin) Start

func (p *Plugin) Start(config pipeline.AnyConfig, params *pipeline.OutputPluginParams)

func (*Plugin) Stop

func (p *Plugin) Stop()