Structured log output from JSON scripts

bash-logstash.sh

#!/bin/bash

# ------BEGIN LOGSTASH------

application_tag="bash"

if [ -z "$LOGFILE" ]; then
  [ -d ~/log ] || mkdir ~/log
  export LOGFILE=~/log/${application_tag}-logstash.log
fi

# Set up the JSON template for Logstash
# json_template for Logstash schema v0
logstash_json_v0_template=$(cat << EOM
{
  "@timestamp": "\$tm",
  "@message": "\$msg",
  "@fields": {
    "pwd": "${PWD}",
    "script_name": "${BASH_SOURCE[0]}",
    "line_number": "\$lno",
    "level": "\$lvl",
    "source_host": "$(hostname)",
    "application_tag": "${application_tag}"
  }
}
EOM
)
# Strip away indentation whitespace. It won't look good in the single-line output.
logstash_json_v0_template=$(echo "$logstash_json_v0_template" | sed -e 's/^\ *//')

# macOS: envsubst is not included by default. use `brew install gettext`
logstash_format_message() {
  lvl="${1}" ; shift
  msg="$@"
  tm=$(date "+%Y-%m-%dT%H:%M:%SZ")
  lno="${BASH_LINENO[1]}" # gets line number where this was called from
  # escape quotation marks
  msg=$(echo "$msg" | sed -e 's/"/\\\"/g')
  # Linebreaks in the original message need to be escaped to fit into JSON
  msg=$(echo "$msg" | awk 1 ORS='\\n')
  # fill the template
  # use tr -d to strip all linebreaks. Beaver expects the entire record on a single line.
  echo "$logstash_json_v0_template" | tm="$tm" lvl="$lvl" msg="$msg" lno="$lno" envsubst | tr -d "\n\r"
  # We do need exactly one linebreak after the JSON message.
  echo ""
}
logstash_info() {
  logstash_format_message INFO "$@" >> "${LOGFILE}"
}
logstash_warn() {
  logstash_format_message WARN "$@" >> "${LOGFILE}"
}
logstash_error() {
  logstash_format_message ERROR "$@" >> "${LOGFILE}"
}

# ------END LOGSTASH------

echo "Writing Logstash logs to \$LOGFILE $LOGFILE"

main() {
  multiline="foo
  bar"
  logstash_warn "test \" ' \" message" "ba'r" 'ba"r' "line\n \nbreaks" "$multiline"
}

main