dom
/
telegraf
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Keep leading whitespace for messages in syslog input (#4498)

This commit is contained in:
Daniel Nelson 2018-07-31 17:15:42 -07:00 committed by Greg
parent ddf2d691e9
commit 6a32a7d85b
3 changed files with 40 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plugins/inputs/syslog/README.md
View File

@ -33,9 +33,9 @@ Syslog messages should be formatted according to
## Only applies to stream sockets (e.g. TCP). ## Only applies to stream sockets (e.g. TCP).
# max_connections = 1024 # max_connections = 1024
## Read timeout (default = 500ms). ## Read timeout is the maximum time allowed for reading a single message (default = 5s).
## 0 means unlimited. ## 0 means unlimited.
# read_timeout = 500ms # read_timeout = "5s"
## Whether to parse in best effort mode or not (default = false). ## Whether to parse in best effort mode or not (default = false).
## By default best effort parsing is off. ## By default best effort parsing is off.

32
plugins/inputs/syslog/rfc5426_test.go
View File

@ -202,6 +202,38 @@ func getTestCasesForRFC5426() []testCase5426 {
}, },
werr: true, werr: true,
}, },
{
name: "trim message",
data: []byte("<1>1 - - - - - - \tA\n"),
wantBestEffort: &testutil.Metric{
Measurement: "syslog",
Fields: map[string]interface{}{
"version": uint16(1),
"message": "\tA",
"facility_code": 0,
"severity_code": 1,
},
Tags: map[string]string{
"severity": "alert",
"facility": "kern",
},
Time: defaultTime,
},
wantStrict: &testutil.Metric{
Measurement: "syslog",
Fields: map[string]interface{}{
"version": uint16(1),
"message": "\tA",
"facility_code": 0,
"severity_code": 1,
},
Tags: map[string]string{
"severity": "alert",
"facility": "kern",
},
Time: defaultTime,
},
},
} }
return testCases return testCases

9
plugins/inputs/syslog/syslog.go
View File

@ -10,6 +10,7 @@ import (
"strings" "strings"
"sync" "sync"
"time" "time"
"unicode"
"github.com/influxdata/go-syslog/rfc5424" "github.com/influxdata/go-syslog/rfc5424"
"github.com/influxdata/go-syslog/rfc5425" "github.com/influxdata/go-syslog/rfc5425"
@ -71,9 +72,9 @@ var sampleConfig = `
## Only applies to stream sockets (e.g. TCP). ## Only applies to stream sockets (e.g. TCP).
# max_connections = 1024 # max_connections = 1024
## Read timeout (default = 500ms). ## Read timeout is the maximum time allowed for reading a single message (default = 5s).
## 0 means unlimited. ## 0 means unlimited.
# read_timeout = 500ms # read_timeout = "5s"
## Whether to parse in best effort mode or not (default = false). ## Whether to parse in best effort mode or not (default = false).
## By default best effort parsing is off. ## By default best effort parsing is off.
@ -365,7 +366,9 @@ func fields(msg rfc5424.SyslogMessage, s *Syslog) map[string]interface{} {
} }
if msg.Message() != nil { if msg.Message() != nil {
flds["message"] = strings.TrimSpace(*msg.Message()) flds["message"] = strings.TrimRightFunc(*msg.Message(), func(r rune) bool {
return unicode.IsSpace(r)
})
} }
if msg.StructuredData() != nil { if msg.StructuredData() != nil {