Contents

require 'sekoia/formatter'

module Fluent
  module Plugin
    class FormatterSEKOIA < Formatter
      Fluent::Plugin.register_formatter('sekoia', self)

      config_param :rfc6587_message_size, :bool, default: false
      config_param :app_name_field, :string, default: "kubernetes.labels.app"
      config_param :proc_id_field, :string, default: "kubernetes.pod_name"
      config_param :intake_key_field, :string, default: "kubernetes.annotations.sekoia-io-intake-key"

      def configure(conf)
        super
        @app_name_field_array = @app_name_field.split(".")
        @proc_id_field_array = @proc_id_field.split(".")
        @intake_key_array = @intake_key_field.split(".")
      end

      def format(tag, time, record)
        log.debug("Record")
        log.debug(record.map { |k, v| "#{k}=#{v}" }.join('&'))

        msg = SEKOIA::Formatter.format(
          log: record['log'],
          timestamp: time,
          app_name: record.dig(*@app_name_field_array) || "-",
          proc_id: record.dig(*@proc_id_field_array) || "-",
          intake_key: record.dig(*@intake_key_array) || ""
        )

        log.debug("RFC 5424 Message")
        log.debug(msg)

        return msg + "\n" unless @rfc6587_message_size

        msg.length.to_s + ' ' + msg
      end
    end
  end
end

Version data entries

2 entries across 2 versions & 1 rubygems

Version	Path
fluent-plugin-sekoia-io-0.0.2	lib/fluent/plugin/formatter_sekoia.rb
fluent-plugin-sekoia-io-0.0.1	lib/fluent/plugin/formatter_sekoia.rb