dom
/
telegraf
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Reformat syslog output documentation

This commit is contained in:
Daniel Nelson 2019-05-08 11:39:03 -07:00
parent 761705c299
commit a0a9da371e
No known key found for this signature in database
GPG Key ID: CAAD59C9444F6155
3 changed files with 68 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
plugins/inputs/syslog/syslog.go
View File

@ -84,7 +84,7 @@ var sampleConfig = `
## The framing technique with which it is expected that messages are transported (default = "octet-counting"). ## The framing technique with which it is expected that messages are transported (default = "octet-counting").
## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), ## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1),
## or the non-transparent framing technique (RFC6587#section-3.4.2). ## or the non-transparent framing technique (RFC6587#section-3.4.2).
## Must be one of "octect-counting", "non-transparent". ## Must be one of "octet-counting", "non-transparent".
# framing = "octet-counting" # framing = "octet-counting"
## The trailer to be expected in case of non-trasparent framing (default = "LF"). ## The trailer to be expected in case of non-trasparent framing (default = "LF").

59
plugins/outputs/syslog/README.md
View File

@ -35,47 +35,51 @@ Syslog messages are formatted according to
## Defaults to the OS configuration. ## Defaults to the OS configuration.
# keep_alive_period = "5m" # keep_alive_period = "5m"
## The framing technique with which it is expected that messages are transported (default = "octet-counting"). ## The framing technique with which it is expected that messages are
## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), ## transported (default = "octet-counting"). Whether the messages come
## or the non-transparent framing technique (RFC6587#section-3.4.2). ## using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1),
## Must be one of "octect-counting", "non-transparent". ## or the non-transparent framing technique (RFC6587#section-3.4.2). Must
## be one of "octet-counting", "non-transparent".
# framing = "octet-counting" # framing = "octet-counting"
## The trailer to be expected in case of non-trasparent framing (default = "LF"). ## The trailer to be expected in case of non-trasparent framing (default = "LF").
## Must be one of "LF", or "NUL". ## Must be one of "LF", or "NUL".
# trailer = "LF" # trailer = "LF"
### SD-PARAMs settings ## SD-PARAMs settings
### A syslog message can contain multiple parameters and multiple identifiers within structured data section ## Syslog messages can contain key/value pairs within zero or more
### A syslog message can contain multiple structured data sections. ## structured data sections. For each unrecognised metric tag/field a
### For each unrecognised metric tag/field a SD-PARAMS can be created. ## SD-PARAMS is created.
### Example ##
### Configuration => ## Example:
### sdparam_separator = "_" ## [[outputs.syslog]]
### default_sdid = "default@32473" ## sdparam_separator = "_"
### sdids = ["foo@123", "bar@456"] ## default_sdid = "default@32473"
### input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1 ## sdids = ["foo@123", "bar@456"]
### output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y] ##
## input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1
## output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y]
## SD-PARAMs separator between the sdid and tag/field key (default = "_") ## SD-PARAMs separator between the sdid and tag/field key (default = "_")
# sdparam_separator = "_" # sdparam_separator = "_"
## Default sdid used for tags/fields that don't contain a prefix defined in the explict sdids setting below ## Default sdid used for tags/fields that don't contain a prefix defined in
## If no default is specified, no SD-PARAMs will be used for unrecognised field. ## the explict sdids setting below If no default is specified, no SD-PARAMs
## will be used for unrecognised field.
# default_sdid = "default@32473" # default_sdid = "default@32473"
##List of explicit prefixes to extract from tag/field keys and use as the SDID, if they match (see above example for more details): ## List of explicit prefixes to extract from tag/field keys and use as the
## SDID, if they match (see above example for more details):
# sdids = ["foo@123", "bar@456"] # sdids = ["foo@123", "bar@456"]
###
## Default severity value. Severity and Facility are used to calculate the message PRI value (RFC5424#section-6.2.1) ## Default severity value. Severity and Facility are used to calculate the
## Used when no metric field with key "severity_code" is defined. ## message PRI value (RFC5424#section-6.2.1). Used when no metric field
## If unset, 5 (notice) is the default ## with key "severity_code" is defined. If unset, 5 (notice) is the default
# default_severity_code = 5 # default_severity_code = 5
## Default facility value. Facility and Severity are used to calculate the message PRI value (RFC5424#section-6.2.1) ## Default facility value. Facility and Severity are used to calculate the
## Used when no metric field with key "facility_code" is defined. ## message PRI value (RFC5424#section-6.2.1). Used when no metric field with
## If unset, 1 (user-level) is the default ## key "facility_code" is defined. If unset, 1 (user-level) is the default
# default_facility_code = 1 # default_facility_code = 1
## Default APP-NAME value (RFC5424#section-6.2.5) ## Default APP-NAME value (RFC5424#section-6.2.5)
@ -85,7 +89,8 @@ Syslog messages are formatted according to
``` ```
### Metric mapping ### Metric mapping
The output plugin expects syslog metrics tags and fields to match up with the ones created in the [syslog input plugin](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/syslog#metrics). The output plugin expects syslog metrics tags and fields to match up with the
ones created in the [syslog input][].
The following table shows the metric tags, field and defaults used to format syslog messages. The following table shows the metric tags, field and defaults used to format syslog messages.
@ -99,3 +104,5 @@ The following table shows the metric tags, field and defaults used to format sys
| MSGID | - | msgid | Metric name | | MSGID | - | msgid | Metric name |
| PROCID | - | procid | - | | PROCID | - | procid | - |
| MSG | - | msg | - | | MSG | - | msg | - |
[syslog input]: /plugins/inputs/syslog#metrics

54
plugins/outputs/syslog/syslog.go
View File

@ -57,47 +57,51 @@ var sampleConfig = `
## Defaults to the OS configuration. ## Defaults to the OS configuration.
# keep_alive_period = "5m" # keep_alive_period = "5m"
## The framing technique with which it is expected that messages are transported (default = "octet-counting"). ## The framing technique with which it is expected that messages are
## Whether the messages come using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1), ## transported (default = "octet-counting"). Whether the messages come
## or the non-transparent framing technique (RFC6587#section-3.4.2). ## using the octect-counting (RFC5425#section-4.3.1, RFC6587#section-3.4.1),
## Must be one of "octect-counting", "non-transparent". ## or the non-transparent framing technique (RFC6587#section-3.4.2). Must
## be one of "octet-counting", "non-transparent".
# framing = "octet-counting" # framing = "octet-counting"
## The trailer to be expected in case of non-trasparent framing (default = "LF"). ## The trailer to be expected in case of non-trasparent framing (default = "LF").
## Must be one of "LF", or "NUL". ## Must be one of "LF", or "NUL".
# trailer = "LF" # trailer = "LF"
### SD-PARAMs settings ## SD-PARAMs settings
### A syslog message can contain multiple parameters and multiple identifiers within structured data section ## Syslog messages can contain key/value pairs within zero or more
### A syslog message can contain multiple structured data sections. ## structured data sections. For each unrecognised metric tag/field a
### For each unrecognised metric tag/field a SD-PARAMS can be created. ## SD-PARAMS is created.
### Example ##
### Configuration => ## Example:
### sdparam_separator = "_" ## [[outputs.syslog]]
### default_sdid = "default@32473" ## sdparam_separator = "_"
### sdids = ["foo@123", "bar@456"] ## default_sdid = "default@32473"
### input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1 ## sdids = ["foo@123", "bar@456"]
### output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y] ##
## input => xyzzy,x=y foo@123_value=42,bar@456_value2=84,something_else=1
## output (structured data only) => [foo@123 value=42][bar@456 value2=84][default@32473 something_else=1 x=y]
## SD-PARAMs separator between the sdid and tag/field key (default = "_") ## SD-PARAMs separator between the sdid and tag/field key (default = "_")
# sdparam_separator = "_" # sdparam_separator = "_"
## Default sdid used for tags/fields that don't contain a prefix defined in the explict sdids setting below ## Default sdid used for tags/fields that don't contain a prefix defined in
## If no default is specified, no SD-PARAMs will be used for unrecognised field. ## the explict sdids setting below If no default is specified, no SD-PARAMs
## will be used for unrecognised field.
# default_sdid = "default@32473" # default_sdid = "default@32473"
##List of explicit prefixes to extract from tag/field keys and use as the SDID, if they match (see above example for more details): ## List of explicit prefixes to extract from tag/field keys and use as the
## SDID, if they match (see above example for more details):
# sdids = ["foo@123", "bar@456"] # sdids = ["foo@123", "bar@456"]
###
## Default severity value. Severity and Facility are used to calculate the message PRI value (RFC5424#section-6.2.1) ## Default severity value. Severity and Facility are used to calculate the
## Used when no metric field with key "severity_code" is defined. ## message PRI value (RFC5424#section-6.2.1). Used when no metric field
## If unset, 5 (notice) is the default ## with key "severity_code" is defined. If unset, 5 (notice) is the default
# default_severity_code = 5 # default_severity_code = 5
## Default facility value. Facility and Severity are used to calculate the message PRI value (RFC5424#section-6.2.1) ## Default facility value. Facility and Severity are used to calculate the
## Used when no metric field with key "facility_code" is defined. ## message PRI value (RFC5424#section-6.2.1). Used when no metric field with
## If unset, 1 (user-level) is the default ## key "facility_code" is defined. If unset, 1 (user-level) is the default
# default_facility_code = 1 # default_facility_code = 1
## Default APP-NAME value (RFC5424#section-6.2.5) ## Default APP-NAME value (RFC5424#section-6.2.5)