[FLUME-1666] Syslog source strips timestamp and hostname from log message body

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.2.0, 1.3.0
• Fix Version/s: 1.5.0
• Component/s: Sinks+Sources

Environment

This occurs with Flume all the way up through 1.3.0.

• Assignee: Jeff Lord
• Reporter: Josh West
• Created: 24/Oct/12 13:21
• Updated: 22/Oct/13 01:51
• Resolved: 10/Oct/13 05:51

Description

The syslog source parses incoming syslog messages. In the process, it strips the timestamp and hostname from each log message, and places them as Event headers.

Thus, a syslog message that would normally look like so (when written via rsyslog or syslogd):

Wed Oct 24 09:18:01 UTC 2012 someserver /USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)

Appears in flume output as:

/USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)

Issue Links

• links to: ReviewBoard