blob: 2d7cbd8b1f1edf84ed7ee2608b36337129eae03c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
# Syslog Format Plugin
This format plugin enables Drill to query syslog formatted data as specified in RFC-5424, as shown below.
```
<165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"]
```
## Configuration Options
This format pluin has the following configuration options:
* **`maxErrors`**: Sets the maximum number of malformatted lines that the format plugin will tolerate before throwing an error and halting execution
* **`flattenStructuredData`**: Syslog data optionally contains a series of key/value pairs known as the structured data. By default, Drill will parse these into a `map`.
```
"syslog": {
"type": "syslog",
"extensions": [ "syslog" ],
"maxErrors": 10,
"flattenStructuredData": false
}
```
## Fields
Since the structure of the data contained in a syslog is well known. In terms of data types, the `event_date` field is a datetime, the `severity_code`, `facility_code`, and `proc_id` are integers and all other fields are VARCHARs.
** Note: All fields, with the exception of the `event_date`, are not required, so not all fields may be present at all times. **
* `event_date`: This is the time of the event
* `severity_code`: The severity code of the event
* `facility_code`: The facility code of the incident
* `severity`: The severity of the event
* `facility`:
* `ip`: The IP address or hostname of the source machine
* `app_name`: The name of the application that is generating the event
* `proc_id`: The process ID of the event that generated the event
* `msg_id`: The identifier of the message
* `message`: The actual message text of the event
* `_raw`: The full text of the event
### Structured Data
Syslog data can contain a list of key/value pairs which Drill will extract in a field called `structured_data`. This field is a Drill Map.
|
