search

emsearcy / fluent-plugin-gelf

Buffered fluentd output plugin to GELF (Graylog2)
Apache License 2.0
33 stars 57 forks source link

Added additional field mappings, clean up gelfentry object #15

Closed dkopack closed 7 years ago

dkopack commented 8 years ago

Added additional field mappings to better parse Logstash style input, standardized gelfentry obj keys as symbols

emsearcy commented 8 years ago

Thanks! Two requests:

First, can you add comments explaining the "logstash-style" fields so that people reading this in the future realize it's logstash-related? I'm not familiar with logstash myself, so it seems odd that these would each write over short_message. I assume only one of the three of these is expected to be set?

Second, for compatibility with other uses of the same field names, would it work to only write over shortmessage if it doesn't already exist (and if it does exist, fall back to `gelfentry[(''+k).to_sym])? I'm not sure if the record.each_pair ordering would handle this alphabetically to ensure that the short_message "record" key is processed first ... perhaps check bothrecord.has_key?(:short_message)andgelfentry.has_key– the first would handle the case I just described, the latter would ensure if somebody has both "request" and "message" fields that, rather than loosing one of them, the one that didn't get put into short_message would get added as:_FIELD`.