Uploaded image for project: 'Flume'
  1. Flume
  2. FLUME-1666

Syslog source strips timestamp and hostname from log message body

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.2.0, 1.3.0
    • Fix Version/s: 1.5.0
    • Component/s: Sinks+Sources
    • Labels:
      None
    • Environment:

      This occurs with Flume all the way up through 1.3.0.

      Description

      The syslog source parses incoming syslog messages. In the process, it strips the timestamp and hostname from each log message, and places them as Event headers.

      Thus, a syslog message that would normally look like so (when written via rsyslog or syslogd):

      Wed Oct 24 09:18:01 UTC 2012 someserver /USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)
      

      Appears in flume output as:

      /USR/SBIN/CRON[26981]: (root) CMD (/usr/local/sbin/somescript)
      

        Attachments

        1. FLUME-1666-SyslogTextSerializer.patch
          4 kB
          Josh West
        2. FLUME-1666-1.patch
          13 kB
          Jeff Lord
        3. FLUME-1666-2.patch
          14 kB
          Jeff Lord
        4. FLUME-1666-3.patch
          14 kB
          Jeff Lord
        5. FLUME-1666-4.patch
          14 kB
          Jeff Lord

          Issue Links

            Activity

              People

              • Assignee:
                jlord Jeff Lord
                Reporter:
                jsw Josh West
              • Votes:
                1 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: