AMQP Input, log Properties and Headers from Raw AMQP Message

[p-8-z]

Some of the AMQP brokers log their events and traces in exchanges (e.g. Rabbitmq amq.rabbitmq.event). These kind of messages are useful for auditing brokers and we would like to consume them with graylog input. Consumed AMQP Messages come with empty body and useful information is stored in AMQP Headers and Properties.

Expected Behavior

• AMQP input should accept empty messages (optional).
• AMQP input should parse headers into message (optional).

Current Behavior

• AMQP input reject empty messages.
• AMQP input can't process message incoming AMQP Headers or Properties.

Possible Solution

• implement optional acceptance for empty messages.
• implement logging of message Headers and Properties.

Context

As a company we would like to log these kind of AMQP messages from broker without any kind of middle man between AMQP broker and Graylog.

[p-8-z]

I already have implementation working.

[mpoeter]

I would also like to access the message header and properties in my inputs - this would be really helpful!

[aitorpazos]

Any update on this one?

This feature would be very useful in combination with RabbitMQ event exchange plugin in order to use Graylog as an audit log store:

Each event has various properties associated with it. These are translated into AMQP 0-9-1 data encoding and inserted in the message headers. The message body is always blank.