diff --git a/config/config.go b/config/config.go index 9672a721..45f9669b 100644 --- a/config/config.go +++ b/config/config.go @@ -20,6 +20,7 @@ type Config struct { ValidateAllJSONTypes bool `config:"validate_all_json_types"` JsonSchema map[string]string `config:"json_schema"` Debug bool `config:"debug"` + ParseGelfLevels bool `config:"parse_gelf_levels"` } var DefaultConfig = Config{ diff --git a/protolog/loglistener.go b/protolog/loglistener.go index cb55f257..29214916 100644 --- a/protolog/loglistener.go +++ b/protolog/loglistener.go @@ -23,6 +23,17 @@ type LogListener struct { logEntriesError chan bool } +var gelfLevels = map[int32]string{ + 0: "emergency", + 1: "alert", + 2: "critical", + 3: "error", + 4: "warning", + 5: "notice", + 6: "info", + 7: "debug", +} + func NewLogListener(cfg config.Config) *LogListener { ll := &LogListener{ config: cfg, @@ -46,10 +57,13 @@ func (ll *LogListener) Start(logEntriesRecieved chan common.MapStr, logEntriesEr address := fmt.Sprintf("%s:%d", ll.config.Address, ll.config.Port) - if ll.config.Protocol == "tcp" { - ll.startTCP(ll.config.Protocol, address) - } else if ll.config.EnableGelf { + if ll.config.EnableGelf { + if ll.config.Protocol == "tcp" { + logp.Err("[protocol: tcp] has no affect together with enable_gelf, starting GELF listener") + } ll.startGELF(address) + } else if ll.config.Protocol == "tcp" { + ll.startTCP(ll.config.Protocol, address) } else { ll.startUDP(ll.config.Protocol, address) } @@ -250,7 +264,13 @@ func (ll *LogListener) processGelfMessage(msg *gelf.Message) { } } - event["level"] = msg.Level + // Parse level to be human readable + if ll.config.ParseGelfLevels { + event["level"] = gelfLevels[msg.Level] + } else { + event["level"] = msg.Level + } + event["facility"] = msg.Facility ll.logEntriesRecieved <- event diff --git a/protologbeat.full.yml b/protologbeat.full.yml index 7dbd2c11..6153ac51 100644 --- a/protologbeat.full.yml +++ b/protologbeat.full.yml @@ -10,6 +10,7 @@ protologbeat: #port: 5000 # Protocol on which to listen + # This has no action if gelf is enabled #protocol: udp # Maxium message size in bytes @@ -30,6 +31,9 @@ protologbeat: # Set process to receive only GELF formated messages #enable_gelf: false + # Parse gelf level to be human readable (6 => "info") + # parse_gelf_levels: false + # Enable json validation with schemas #enable_json_validation: false