Logback standard output parser for Heka

nitro_logback.lua

-- A Heka Decoder for a semi-standard logback entry

local os = require("os")
local lpeg = require("lpeg")

local dash = lpeg.P("-")
local colon = lpeg.P(":")
local space = lpeg.S(" \t")
local eol = lpeg.P(-1)

local year = lpeg.Cg(lpeg.R("09")^-4, "year")
local month = lpeg.Cg(lpeg.R("09")^-2, "month")
local day = lpeg.Cg(lpeg.R("09")^-2, "day")

local hour = lpeg.Cg(lpeg.R("09")^-2, "hour")
local min = lpeg.Cg(lpeg.R("09")^-2, "min")
local sec = lpeg.Cg(lpeg.R("09")^-2, "sec")

local date = year * dash * month * dash * day
local time = hour * colon * min * colon * sec
local datetime = lpeg.P("[") * lpeg.Cg(date * space * time, "datetime") * lpeg.P(1)^-4 *
 lpeg.P("]")

local severity = lpeg.Cg(lpeg.R("AZ")^4, "severity")

local thread = lpeg.P("[") * lpeg.Cg((lpeg.P(1) - lpeg.P("]"))^0, "thread") * lpeg.P("]"
) * lpeg.P(",")^0
local message = thread^0 * lpeg.Cg(lpeg.P(1)^1, "message")

local grammar = datetime^0 * space^0 * severity^0 * space^0 * message * eol
local capture = lpeg.Ct(grammar)

-- Construct a Lua time and then multiply out to Go time
function make_time(year, month, day, hour, min, sec)
	if not year or not month or not day or not hour or not min or not sec then
		return os.time() * 1e9
	end

	time_table = { year=year, day=day, hour=hour, min=min, sec=sec }
 	return os.time(time_table) * 1e9
end

-- Syslog severity levels to logback label mapping
local severity_levels = {
	FATAL = 3,
	WARN = 4,
	INFO = 6
}

function make_severity(severity)
	-- Return a mapped level if we know it
	if severity_levels[severity] then
		return severity_levels[severity]
	end

	-- Otherwise it's "notice"
	return 5
end

function process_message()
	local message = read_message("Payload")
  	local fields = capture:match(message)

	if not message then
		return -1
	end

	if fields["severity"] then
		local sev = make_severity(fields["severity"])
		write_message("Severity", sev, nil, 0, 0)
	end

	if fields["datetime"] then
		local timestamp = make_time(
			fields["year"],
   			fields["month"],
			fields["day"],
			fields["hour"],
			fields["min"],
			fields["sec"]
		)
		write_message("Timestamp", timestamp, nil, 0, 0)
	end

	if fields["thread"] then
		write_message("Fields[Thread]", fields["Thread"], "string", 0, 0)
	end

	write_message("Payload", fields["message"], nil, 0, 0)
	return 0
end