From c7faba286016fd669985fb3126cbc062cacebc0a Mon Sep 17 00:00:00 2001 From: Andrei Burd Date: Thu, 8 Mar 2018 17:59:56 +0200 Subject: [PATCH 1/2] Feat: handling extra fields in gelf --- protolog/loglistener.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/protolog/loglistener.go b/protolog/loglistener.go index cb55f257..ef8476ea 100644 --- a/protolog/loglistener.go +++ b/protolog/loglistener.go @@ -236,6 +236,10 @@ func (ll *LogListener) processGelfMessage(msg *gelf.Message) { event["short_message"] = msg.Short event["full_message"] = msg.Full + for name,value := range msg.Extra { + event[name] = value + } + // 1 ms = 1000000 ns if msg.TimeUnix == 0 { event["@timestamp"] = common.Time(time.Now()) From 25d698b518285e49058148095677b553f4d64125 Mon Sep 17 00:00:00 2001 From: Andrei Burd Date: Sun, 11 Mar 2018 13:17:56 +0200 Subject: [PATCH 2/2] FIX: took out default type field because of ES 6.xx deprecation --- beater/protologbeat.go | 3 --- config/config.go | 2 -- protolog/loglistener.go | 1 - protologbeat.full.yml | 5 +---- 4 files changed, 1 insertion(+), 10 deletions(-) diff --git a/beater/protologbeat.go b/beater/protologbeat.go index c4e75952..40e6e440 100644 --- a/beater/protologbeat.go +++ b/beater/protologbeat.go @@ -59,9 +59,6 @@ func (bt *Protologbeat) Run(b *beat.Beat) error { if event == nil { return nil } - if _, ok := event["type"]; !ok { - event["type"] = bt.config.DefaultEsLogType - } bt.client.PublishEvent(event) logp.Info("Event sent") } diff --git a/config/config.go b/config/config.go index 9672a721..2b7960b8 100644 --- a/config/config.go +++ b/config/config.go @@ -13,7 +13,6 @@ type Config struct { MaxMsgSize int `config:"max_msg_size"` JsonMode bool `config:"json_mode"` EnableGelf bool `config:"enable_gelf"` - DefaultEsLogType string `config:"default_es_log_type"` MergeFieldsToRoot bool `config:"merge_fields_to_root"` EnableSyslogFormatOnly bool `config:"enable_syslog_format_only"` EnableJsonValidation bool `config:"enable_json_validation"` @@ -30,7 +29,6 @@ var DefaultConfig = Config{ MaxMsgSize: 4096, JsonMode: false, EnableGelf: false, - DefaultEsLogType: "protologbeat", MergeFieldsToRoot: false, EnableSyslogFormatOnly: false, EnableJsonValidation: false, diff --git a/protolog/loglistener.go b/protolog/loglistener.go index ef8476ea..12472d34 100644 --- a/protolog/loglistener.go +++ b/protolog/loglistener.go @@ -232,7 +232,6 @@ func (ll *LogListener) processGelfMessage(msg *gelf.Message) { event := common.MapStr{} event["gelf"] = map[string]interface{}{"version": msg.Version} event["host"] = msg.Host - event["type"] = ll.config.DefaultEsLogType event["short_message"] = msg.Short event["full_message"] = msg.Full diff --git a/protologbeat.full.yml b/protologbeat.full.yml index 7dbd2c11..d88d26b9 100644 --- a/protologbeat.full.yml +++ b/protologbeat.full.yml @@ -17,10 +17,7 @@ protologbeat: # Enable accepting on JSON formated messages #json_mode: true - - # Default elasticsearch type to use if no type is present in the message - #default_es_log_type: protologbeat - + # Wether to place the parsed json data at the root level or nested in a 'log' object #merge_fields_to_root: true