Parse timeQuality in RFC5424 messages

guedressel commented 7 years ago

In a test of this plugin I found the timeQuality (RFC5424, Section 7.1) part of the message not being parsed. Would be nice if it gets added to the parser.

scheuk commented 7 years ago

The plugin doesn't parse the structured data section. It will put simply put the structured data into the message section of the fluentd record. What would you like to see from a record perspective if we parsed the structured data?

guedressel commented 7 years ago

After some thinking and reading I now see this issue as a bigger story: My suggestion is to parse the whole Structured-Data parts (RFC5424, Section 6.3) into a key "data" (or maybe "sdata"?).

A parsed syslog event could then look like this:

{
  "host":"host-name",
  "ident":"user",
  "pid":"-",
  "msgid":"-",
  "message":"log message"
  "data": {
    "timeQuality": {
      "tzKnown": 1,
      "isSynced": 1,
      "syncAccuracy": 288500
      }
    },
    "origin": {
      "ip": [ "10.9.8.7", "10.9.4.3"],
      "enterpriseId": "",
      "software": "the-better-app",
      "swVersion": "42"
    },
    "meta": {
      "sequenceId": 11,
      "sysUpTime": 23342390
      "language": "en-US"
    },
    "exampleSDID@32473": {
      "iut": "3",
      "eventSource"="Application",
      "eventID"="1011"
    },
    "examplePriority@32473": {
      "class"="high"
    }
  }
}

What do you think about it?

athenahealth / fluent-plugin-newsyslog

Parse timeQuality in RFC5424 messages #4