You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flume.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2018/11/08 18:22:01 UTC
[jira] [Commented] (FLUME-3133) Add a ipHeader config in Syslog
Sources
[ https://issues.apache.org/jira/browse/FLUME-3133?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16680147#comment-16680147 ]
ASF GitHub Bot commented on FLUME-3133:
---------------------------------------
GitHub user turcsanyip opened a pull request:
https://github.com/apache/flume/pull/234
FLUME-3133 Add client IP / hostname headers to Syslog sources.
In the newer version of the Syslog message format (RFC-5424) the hostname
is not a mandatory header anymore so the Syslog client might not send it.
On the Flume side it would be a useful information that could be used
in interceptors or for event routing.
To keep this information, two new properties have been added to the Syslog
sources: clientIPHeader and clientHostnameHeader.
Flume users can define custom event header names through these parameters
for storing the IP address / hostname of the Syslog client in the Flume
event as headers.
The IP address / hostname are retrieved from the underlying network sockets,
not from the Syslog message.
This change is based on the patch submitted by Jinjiang Ling which has been
rebased onto the current trunk and the review comments have been implemented.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/turcsanyip/flume FLUME-3133
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/flume/pull/234.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #234
----
commit ec5af4aaf9cf9884ca6a9d4ef681a5fa4c4155a6
Author: turcsanyi <tu...@...>
Date: 2018-11-08T14:32:59Z
FLUME-3133 Add client IP / hostname headers to Syslog sources.
In the newer version of the Syslog message format (RFC-5424) the hostname
is not a mandatory header anymore so the Syslog client might not send it.
On the Flume side it would be a useful information that could be used
in interceptors or for event routing.
To keep this information, two new properties have been added to the Syslog
sources: clientIPHeader and clientHostnameHeader.
Flume users can define custom event header names through these parameters
for storing the IP address / hostname of the Syslog client in the Flume
event as headers.
The IP address / hostname are retrieved from the underlying network sockets,
not from the Syslog message.
This change is based on the patch submitted by Jinjiang Ling which has been
rebased onto the current trunk and the review comments have been implemented.
----
> Add a ipHeader config in Syslog Sources
> ---------------------------------------
>
> Key: FLUME-3133
> URL: https://issues.apache.org/jira/browse/FLUME-3133
> Project: Flume
> Issue Type: Bug
> Components: Sinks+Sources
> Affects Versions: 1.7.0
> Reporter: Jinjiang Ling
> Assignee: Peter Turcsanyi
> Priority: Major
> Attachments: FLUME-3133.patch
>
>
> When I use the syslog source to collect log from other hosts, my config like this
> {quote}
> ...
> a1.sources.r1.host = 0.0.0.0
> a1.sources.r1.ports = 5140
> ...
> {quote}
> I'm using the "host" header to tell where the event come from.
> However, when the syslog format is changed, the "host" header will miss.
> In this sence, I couldn't tell where the event come from.
> So I add a new config "ipHeader", it's similar to "portHeader" in Multiport Syslog TCP Source.
> It can be used like this
> {quote}
> ...
> a1.sources.r1.host = 0.0.0.0
> a1.sources.r1.ports = 5140
> a1.sources.r1.ipHeader = test_ip_header
> ...
> {quote}
> Then I can get a header named "test_ip_header" in the event, the value is the ip of host which send this event.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@flume.apache.org
For additional commands, e-mail: issues-help@flume.apache.org