module ViaqDataModelFilterSystemd

Constants

JOURNAL_FIELD_MAP_SYSTEMD_K
JOURNAL_FIELD_MAP_SYSTEMD_T

map of journal fields to viaq data model field

JOURNAL_FIELD_MAP_SYSTEMD_U
JOURNAL_TIME_FIELDS

Public Instance Methods

process_journal_fields(tag, time, record, fmtr_type) click to toggle source
# File lib/fluent/plugin/filter_viaq_data_model_systemd.rb, line 68
def process_journal_fields(tag, time, record, fmtr_type)
  systemd_t = {}
  JOURNAL_FIELD_MAP_SYSTEMD_T.each do |jkey, key|
    if record.key?(jkey)
      systemd_t[key] = record[jkey]
    end
  end
  systemd_u = {}
  JOURNAL_FIELD_MAP_SYSTEMD_U.each do |jkey, key|
    if record.key?(jkey)
      systemd_u[key] = record[jkey]
    end
  end
  systemd_k = {}
  JOURNAL_FIELD_MAP_SYSTEMD_K.each do |jkey, key|
    if record.key?(jkey)
      systemd_k[key] = record[jkey]
    end
  end
  unless systemd_t.empty?
    (record['systemd'] ||= {})['t'] = systemd_t
  end
  unless systemd_u.empty?
    (record['systemd'] ||= {})['u'] = systemd_u
  end
  unless systemd_k.empty?
    (record['systemd'] ||= {})['k'] = systemd_k
  end
  record['level'] = normalize_level(record['level'], nil, nil, record['PRIORITY'])
  JOURNAL_TIME_FIELDS.each do |field|
    if (val = record[field])
      vali = val.to_i
      record['time'] = Time.at(vali / 1000000, vali % 1000000).utc.to_datetime.rfc3339(6)
      break
    end
  end
  case fmtr_type
  when :sys_journal
    record['message'] = record['MESSAGE']
    if record['_HOSTNAME'].eql?('localhost') && @docker_hostname
      record['hostname'] = @docker_hostname
    else
      record['hostname'] = record['_HOSTNAME']
    end
  when :k8s_journal
    record['message'] = record['message'] || record['MESSAGE'] || record['log']
    if record.key?('kubernetes') && record['kubernetes'].respond_to?(:fetch) &&           (k8shost = record['kubernetes'].fetch('host', nil))
      record['hostname'] = k8shost
    elsif @docker_hostname
      record['hostname'] = @docker_hostname
    else
      record['hostname'] = record['_HOSTNAME']
    end
    transform_eventrouter(tag, record)
  end
end