From a0a9da371eb848ebe2e4b02da377da71c469f46b Mon Sep 17 00:00:00 2001 From: Daniel Nelson Date: Wed, 8 May 2019 11:39:03 -0700 Subject: [PATCH] Reformat syslog output documentation --- plugins/inputs/syslog/syslog.go | 2 +- plugins/outputs/syslog/README.md | 65 ++++++++++++++++++-------------- plugins/outputs/syslog/syslog.go | 58 +++++++++++++++------------- 3 files changed, 68 insertions(+), 57 deletions(-) diff --git a/plugins/inputs/syslog/syslog.go b/plugins/inputs/syslog/syslog.go index e1e918759..43d02de5e 100644 --- a/plugins/inputs/syslog/syslog.go +++ b/plugins/inputs/syslog/syslog.go @@ -84,7 +84,7 @@ var sampleConfig = ` ## The framing technique with which it is expected that messages are transported (default = "octet-counting"). ## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), ## or the non-transparent framing technique (RFC6587#section-3.4.2). - ## Must be one of "octect-counting", "non-transparent". + ## Must be one of "octet-counting", "non-transparent". # framing = "octet-counting" ## The trailer to be expected in case of non-trasparent framing (default = "LF"). diff --git a/plugins/outputs/syslog/README.md b/plugins/outputs/syslog/README.md index 8655cbd6a..65f038f57 100644 --- a/plugins/outputs/syslog/README.md +++ b/plugins/outputs/syslog/README.md @@ -35,57 +35,62 @@ Syslog messages are formatted according to ## Defaults to the OS configuration. # keep_alive_period = "5m" - ## The framing technique with which it is expected that messages are transported (default = "octet-counting"). - ## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), - ## or the non-transparent framing technique (RFC6587#section-3.4.2). - ## Must be one of "octect-counting", "non-transparent". + ## The framing technique with which it is expected that messages are + ## transported (default = "octet-counting"). Whether the messages come + ## using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), + ## or the non-transparent framing technique (RFC6587#section-3.4.2). Must + ## be one of "octet-counting", "non-transparent". # framing = "octet-counting" ## The trailer to be expected in case of non-trasparent framing (default = "LF"). ## Must be one of "LF", or "NUL". # trailer = "LF" - ### SD-PARAMs settings - ### A syslog message can contain multiple parameters and multiple identifiers within structured data section - ### A syslog message can contain multiple structured data sections. - ### For each unrecognised metric tag/field a SD-PARAMS can be created. - ### Example - ### Configuration => - ### sdparam_separator = "_" - ### default_sdid = "default@32473" - ### sdids = ["foo@123", "bar@456"] - ### input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1 - ### output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y] + ## SD-PARAMs settings + ## Syslog messages can contain key/value pairs within zero or more + ## structured data sections. For each unrecognised metric tag/field a + ## SD-PARAMS is created. + ## + ## Example: + ## [[outputs.syslog]] + ## sdparam_separator = "_" + ## default_sdid = "default@32473" + ## sdids = ["foo@123", "bar@456"] + ## + ## input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1 + ## output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y] - ## SD-PARAMs separator between the sdid and tag/field key (default = "_") + ## SD-PARAMs separator between the sdid and tag/field key (default = "_") # sdparam_separator = "_" - ## Default sdid used for tags/fields that don't contain a prefix defined in the explict sdids setting below - ## If no default is specified, no SD-PARAMs will be used for unrecognised field. + ## Default sdid used for tags/fields that don't contain a prefix defined in + ## the explict sdids setting below If no default is specified, no SD-PARAMs + ## will be used for unrecognised field. # default_sdid = "default@32473" - ##List of explicit prefixes to extract from tag/field keys and use as the SDID, if they match (see above example for more details): + ## List of explicit prefixes to extract from tag/field keys and use as the + ## SDID, if they match (see above example for more details): # sdids = ["foo@123", "bar@456"] - ### - ## Default severity value. Severity and Facility are used to calculate the message PRI value (RFC5424#section-6.2.1) - ## Used when no metric field with key "severity_code" is defined. - ## If unset, 5 (notice) is the default + ## Default severity value. Severity and Facility are used to calculate the + ## message PRI value (RFC5424#section-6.2.1). Used when no metric field + ## with key "severity_code" is defined. If unset, 5 (notice) is the default # default_severity_code = 5 - ## Default facility value. Facility and Severity are used to calculate the message PRI value (RFC5424#section-6.2.1) - ## Used when no metric field with key "facility_code" is defined. - ## If unset, 1 (user-level) is the default + ## Default facility value. Facility and Severity are used to calculate the + ## message PRI value (RFC5424#section-6.2.1). Used when no metric field with + ## key "facility_code" is defined. If unset, 1 (user-level) is the default # default_facility_code = 1 - ## Default APP-NAME value (RFC5424#section-6.2.5) + ## Default APP-NAME value (RFC5424#section-6.2.5) ## Used when no metric tag with key "appname" is defined. ## If unset, "Telegraf" is the default # default_appname = "Telegraf" ``` ### Metric mapping -The output plugin expects syslog metrics tags and fields to match up with the ones created in the [syslog input plugin](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/syslog#metrics). +The output plugin expects syslog metrics tags and fields to match up with the +ones created in the [syslog input][]. The following table shows the metric tags, field and defaults used to format syslog messages. @@ -98,4 +103,6 @@ The following table shows the metric tags, field and defaults used to format sys | HOSTNAME | hostname OR source OR host | - | os.Hostname() | | MSGID | - | msgid | Metric name | | PROCID | - | procid | - | -| MSG | - | msg | - | \ No newline at end of file +| MSG | - | msg | - | + +[syslog input]: /plugins/inputs/syslog#metrics diff --git a/plugins/outputs/syslog/syslog.go b/plugins/outputs/syslog/syslog.go index 684806b85..013db94a1 100644 --- a/plugins/outputs/syslog/syslog.go +++ b/plugins/outputs/syslog/syslog.go @@ -57,50 +57,54 @@ var sampleConfig = ` ## Defaults to the OS configuration. # keep_alive_period = "5m" - ## The framing technique with which it is expected that messages are transported (default = "octet-counting"). - ## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), - ## or the non-transparent framing technique (RFC6587#section-3.4.2). - ## Must be one of "octect-counting", "non-transparent". + ## The framing technique with which it is expected that messages are + ## transported (default = "octet-counting"). Whether the messages come + ## using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), + ## or the non-transparent framing technique (RFC6587#section-3.4.2). Must + ## be one of "octet-counting", "non-transparent". # framing = "octet-counting" ## The trailer to be expected in case of non-trasparent framing (default = "LF"). ## Must be one of "LF", or "NUL". # trailer = "LF" - ### SD-PARAMs settings - ### A syslog message can contain multiple parameters and multiple identifiers within structured data section - ### A syslog message can contain multiple structured data sections. - ### For each unrecognised metric tag/field a SD-PARAMS can be created. - ### Example - ### Configuration => - ### sdparam_separator = "_" - ### default_sdid = "default@32473" - ### sdids = ["foo@123", "bar@456"] - ### input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1 - ### output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y] + ## SD-PARAMs settings + ## Syslog messages can contain key/value pairs within zero or more + ## structured data sections. For each unrecognised metric tag/field a + ## SD-PARAMS is created. + ## + ## Example: + ## [[outputs.syslog]] + ## sdparam_separator = "_" + ## default_sdid = "default@32473" + ## sdids = ["foo@123", "bar@456"] + ## + ## input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1 + ## output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y] - ## SD-PARAMs separator between the sdid and tag/field key (default = "_") + ## SD-PARAMs separator between the sdid and tag/field key (default = "_") # sdparam_separator = "_" - ## Default sdid used for tags/fields that don't contain a prefix defined in the explict sdids setting below - ## If no default is specified, no SD-PARAMs will be used for unrecognised field. + ## Default sdid used for tags/fields that don't contain a prefix defined in + ## the explict sdids setting below If no default is specified, no SD-PARAMs + ## will be used for unrecognised field. # default_sdid = "default@32473" - ##List of explicit prefixes to extract from tag/field keys and use as the SDID, if they match (see above example for more details): + ## List of explicit prefixes to extract from tag/field keys and use as the + ## SDID, if they match (see above example for more details): # sdids = ["foo@123", "bar@456"] - ### - ## Default severity value. Severity and Facility are used to calculate the message PRI value (RFC5424#section-6.2.1) - ## Used when no metric field with key "severity_code" is defined. - ## If unset, 5 (notice) is the default + ## Default severity value. Severity and Facility are used to calculate the + ## message PRI value (RFC5424#section-6.2.1). Used when no metric field + ## with key "severity_code" is defined. If unset, 5 (notice) is the default # default_severity_code = 5 - ## Default facility value. Facility and Severity are used to calculate the message PRI value (RFC5424#section-6.2.1) - ## Used when no metric field with key "facility_code" is defined. - ## If unset, 1 (user-level) is the default + ## Default facility value. Facility and Severity are used to calculate the + ## message PRI value (RFC5424#section-6.2.1). Used when no metric field with + ## key "facility_code" is defined. If unset, 1 (user-level) is the default # default_facility_code = 1 - ## Default APP-NAME value (RFC5424#section-6.2.5) + ## Default APP-NAME value (RFC5424#section-6.2.5) ## Used when no metric tag with key "appname" is defined. ## If unset, "Telegraf" is the default # default_appname = "Telegraf"