search

logstash-plugins / logstash-input-syslog

Apache License 2.0
37 stars 38 forks source link

Add syslog_field to address codec pre-parsing data #48

Closed untergeek closed 6 years ago

untergeek commented 6 years ago

Problem: CEF codec munges fields before syslog_relay method

  1. The decode method uses the codec first
  2. The CEF codec overwrites the message field, and puts the syslog data into a field called syslog
  3. If using the CEF codec, and the severity, facility (and/or priority) are not contained as a CEF field, these cannot be easily extracted without needing another plugin. The timestamp also would require another step.

Proposed Solution

  1. Allow for a customizable syslog_field configuration option.

This field will default to message, which will make it completely transparent to all current users.

The combination of the recently added grok_pattern and this new syslog_field should allow the syslog input plugin to completely handle CEF (or other codec formats) while preserving the syslog extracted data.