Flume
  1. Flume
  2. FLUME-1666

Syslog source strips timestamp and hostname from log message body

    Details

    • Type: Bug Bug
    • Status: Resolved
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: v1.2.0, v1.3.0
    • Fix Version/s: v1.5.0
    • Component/s: Sinks+Sources
    • Labels:
      None
    • Environment:

      This occurs with Flume all the way up through 1.3.0.

      Description

      The syslog source parses incoming syslog messages. In the process, it strips the timestamp and hostname from each log message, and places them as Event headers.

      Thus, a syslog message that would normally look like so (when written via rsyslog or syslogd):

      Wed Oct 24 09:18:01 UTC 2012 someserver /USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)
      

      Appears in flume output as:

      /USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)
      
      1. FLUME-1666-SyslogTextSerializer.patch
        4 kB
        Josh West
      2. FLUME-1666-4.patch
        14 kB
        Jeff Lord
      3. FLUME-1666-3.patch
        14 kB
        Jeff Lord
      4. FLUME-1666-2.patch
        14 kB
        Jeff Lord
      5. FLUME-1666-1.patch
        13 kB
        Jeff Lord

        Issue Links

          Activity

          No work has yet been logged on this issue.

            People

            • Assignee:
              Jeff Lord
              Reporter:
              Josh West
            • Votes:
              1 Vote for this issue
              Watchers:
              8 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development