map of journal fields to viaq data model field
# File lib/fluent/plugin/filter_viaq_data_model_systemd.rb, line 68 def process_journal_fields(tag, time, record, fmtr_type) systemd_t = {} JOURNAL_FIELD_MAP_SYSTEMD_T.each do |jkey, key| if record.key?(jkey) systemd_t[key] = record[jkey] end end systemd_u = {} JOURNAL_FIELD_MAP_SYSTEMD_U.each do |jkey, key| if record.key?(jkey) systemd_u[key] = record[jkey] end end systemd_k = {} JOURNAL_FIELD_MAP_SYSTEMD_K.each do |jkey, key| if record.key?(jkey) systemd_k[key] = record[jkey] end end unless systemd_t.empty? (record['systemd'] ||= {})['t'] = systemd_t end unless systemd_u.empty? (record['systemd'] ||= {})['u'] = systemd_u end unless systemd_k.empty? (record['systemd'] ||= {})['k'] = systemd_k end begin pri_index = ('%d' % record['PRIORITY'] || 9).to_i case when pri_index < 0 pri_index = 9 when pri_index > 9 pri_index = 9 end rescue pri_index = 9 end record['level'] = ["emerg", "alert", "crit", "err", "warning", "notice", "info", "debug", "trace", "unknown"][pri_index] JOURNAL_TIME_FIELDS.each do |field| if (val = record[field]) vali = val.to_i record['time'] = Time.at(vali / 1000000, vali % 1000000).utc.to_datetime.rfc3339(6) break end end case fmtr_type when :sys_journal record['message'] = record['MESSAGE'] if record['_HOSTNAME'].eql?('localhost') && @docker_hostname record['hostname'] = @docker_hostname else record['hostname'] = record['_HOSTNAME'] end when :k8s_journal record['message'] = record['message'] || record['MESSAGE'] || record['log'] if record.key?('kubernetes') && record['kubernetes'].respond_to?(:fetch) && (k8shost = record['kubernetes'].fetch('host', nil)) record['hostname'] = k8shost elsif @docker_hostname record['hostname'] = @docker_hostname else record['hostname'] = record['_HOSTNAME'] end transform_eventrouter(tag, record) end end