-
Type:
Bug
-
Status: Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 1.2.0, 1.3.0
-
Fix Version/s: 1.5.0
-
Component/s: Sinks+Sources
-
Labels:None
-
Environment:
This occurs with Flume all the way up through 1.3.0.
The syslog source parses incoming syslog messages. In the process, it strips the timestamp and hostname from each log message, and places them as Event headers.
Thus, a syslog message that would normally look like so (when written via rsyslog or syslogd):
Wed Oct 24 09:18:01 UTC 2012 someserver /USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)
Appears in flume output as:
/USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)
- links to