Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
heka syslog with fallback
[rsyslog-with-fallback-decoder]
type = "MultiDecoder"
subs = ['WellFormedRyslogForwardFormatDecoder', 'BestGuessRyslogForwardFormatDecoder', 'SyslogParseFailureDecoder']
cascade_strategy = "first-wins"
[WellFormedRyslogForwardFormatDecoder]
type = "SandboxDecoder"
module_directory = "/usr/share/heka/lua_modules"
filename = "/usr/share/heka/lua_decoders/rsyslog.lua"
script_type = "lua"
[WellFormedRyslogForwardFormatDecoder.config]
template = '<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%'
# We use date-rfc3339 so don't set this off UTC, or face double-offsets.
tz = "UTC"
[BestGuessRyslogForwardFormatDecoder]
type = "SandboxDecoder"
module_directory = "/usr/share/heka/lua_modules"
filename = "/usr/share/heka/lua_decoders/rsyslog.lua"
script_type = "lua"
[BestGuessRyslogForwardFormatDecoder.config]
# Example:
# <166>2014-06-26T23:13:23-07:00 chi-prod-dirac-54.nr-ops.net at org.apache.http.impl.io.AbstractSessionInputBuffer.readLine(AbstractSessionInputBuffer.java:281)\u000a
template = '<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %msg%'
tz = "UTC"
[SyslogParseFailureDecoder]
type = "ScribbleDecoder"
[SyslogParseFailureDecoder.message_fields]
Type = "SyslogParseFailure"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.