Open akkornel opened 2 years ago
Severity mapping and code mapping are both good feature requests.
Are you actually having problems with the message and timestamp? Those should work fine without any additional translation.
I'm going to reopen this since it looks like we haven't fixed MESSAGE
yet.
Is there any ETA for this to be fixed and released?
Hello!
I am looking at using the Ops Agent for my GCP project, and I'm especially interested in using the
systemd_journald
receiver. I am interested in this because journald is already collecting logs for me, and it would be great to take advantage of journald's structured-log format.Even though the receiver is doing the work of pulling in logs from journald, the log entries coming from journald aren't in a form that Cloud Logging can process. So, my request is that the Ops Agent's systemd_journald receiver be enhanced to transform the JSON entries from systemd's schema to Cloud Logging's schema.
One key from the JSON needs a simple key change:
MESSAGE
needs to change tomessage
.One key needs both a key change and a value change:
SYSLOG_PRIORITY
is a numeric priority encoded as a string. The key name needs to change toseverity
, and the value needs to be mapped to an acceptable-to-Cloud-Logging string using the following mapping:7
maps toDEBUG
6
maps toINFO
5
maps toNOTICE
4
maps toWARNING
3
maps toERROR
2
maps toCRITICAL
1
maps toALERT
0
maps toEMERGENCY
There are three keys which could be present and, if so, need to trigger the creation of the
logging.googleapis.com/sourceLocation
object:CODE_FILE
: If present, it should be added to thelogging.googleapis.com/sourceLocation
object, under keyfile
.CODE_LINE
: If present, it should be added to thelogging.googleapis.com/sourceLocation
object, under keyline
.CODE_FUNC
: If present, it should be added to thelogging.googleapis.com/sourceLocation
object, under keyfunction
.Finally, the timestamp object has to be created by applying some math to the
__REALTIME_TIMESTAMP
key:For the
timestampSeconds
key: Take the value from⌊__REALTIME_TIMESTAMP ÷ 1000000⌋
. For thetimestampNanos
key: Take the value from__REALTIME_TIMESTAMP mod 1000000 × 1000
.