fluentd 0.12.40 → 0.14.0

data/lib/fluent/plugin/parser_json.rb

@@ -0,0 +1,79 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+require 'fluent/time'
+
+require 'yajl'
+
+module Fluent
+  module Plugin
+    class JSONParser < Parser
+      Plugin.register_parser('json', self)
+
+      config_param :time_key, :string, default: 'time'
+      config_param :time_format, :string, default: nil
+      config_param :json_parser, :string, default: 'oj'
+
+      def configure(conf)
+        super
+
+        unless @time_format.nil?
+          @time_parser = TimeParser.new(@time_format)
+          @mutex = Mutex.new
+        end
+
+        begin
+          raise LoadError unless @json_parser == 'oj'
+          require 'oj'
+          Oj.default_options = {bigdecimal_load: :float}
+          @load_proc = Oj.method(:load)
+          @error_class = Oj::ParseError
+        rescue LoadError
+          @load_proc = Yajl.method(:load)
+          @error_class = Yajl::ParseError
+        end
+      end
+
+      def parse(text)
+        record = @load_proc.call(text)
+
+        value = @keep_time_key ? record[@time_key] : record.delete(@time_key)
+        if value
+          if @time_format
+            time = @mutex.synchronize { @time_parser.parse(value) }
+          else
+            begin
+              time = Fluent::EventTime.from_time(Time.at(value.to_f))
+            rescue => e
+              raise ParserError, "invalid time value: value = #{value}, error_class = #{e.class.name}, error = #{e.message}"
+            end
+          end
+        else
+          if @estimate_current_event
+            time = Fluent::EventTime.now
+          else
+            time = nil
+          end
+        end
+
+        yield time, record
+      rescue @error_class
+        yield nil, nil
+      end
+    end
+  end
+end

data/lib/fluent/plugin/parser_ltsv.rb

@@ -0,0 +1,50 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+require 'fluent/time'
+
+module Fluent
+  module Plugin
+    class LabeledTSVParser < ValuesParser
+      Plugin.register_parser('ltsv', self)
+
+      config_param :delimiter,       :string, default: "\t"
+      config_param :label_delimiter, :string, default: ":"
+      config_param :time_key, :string, default: "time"
+
+      def configure(conf)
+        # this assignment is not to raise ConfigError in ValuesParser#configure
+        conf['keys'] = conf['time_key'] || 'time'
+        super(conf)
+      end
+
+      def parse(text)
+        # TODO: thread unsafe: @keys might be changed by other threads
+        @keys  = []
+        values = []
+
+        text.split(delimiter).each do |pair|
+          key, value = pair.split(label_delimiter, 2)
+          @keys.push(key)
+          values.push(value)
+        end
+
+        yield values_map(values)
+      end
+    end
+  end
+end

data/lib/fluent/plugin/parser_multiline.rb

@@ -0,0 +1,102 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+
+module Fluent
+  module Plugin
+    class MultilineParser < Parser
+      Plugin.register_parser('multiline', self)
+
+      config_param :format_firstline, :string, default: nil
+
+      FORMAT_MAX_NUM = 20
+
+      def configure(conf)
+        super
+
+        formats = parse_formats(conf).compact.map { |f| f[1..-2] }.join
+        begin
+          @regex = Regexp.new(formats, Regexp::MULTILINE)
+          if @regex.named_captures.empty?
+            raise "No named captures"
+          end
+          @parser = RegexpParser.new(@regex, conf)
+        rescue => e
+          raise ConfigError, "Invalid regexp '#{formats}': #{e}"
+        end
+
+        if @format_firstline
+          check_format_regexp(@format_firstline, 'format_firstline')
+          @firstline_regex = Regexp.new(@format_firstline[1..-2])
+        end
+      end
+
+      def parse(text, &block)
+        @parser.call(text, &block)
+      end
+
+      def has_firstline?
+        !!@format_firstline
+      end
+
+      def firstline?(text)
+        @firstline_regex.match(text)
+      end
+
+      private
+
+      def parse_formats(conf)
+        check_format_range(conf)
+
+        prev_format = nil
+        (1..FORMAT_MAX_NUM).map { |i|
+          format = conf["format#{i}"]
+          if (i > 1) && prev_format.nil? && !format.nil?
+            raise ConfigError, "Jump of format index found. format#{i - 1} is missing."
+          end
+          prev_format = format
+          next if format.nil?
+
+          check_format_regexp(format, "format#{i}")
+          format
+        }
+      end
+
+      def check_format_range(conf)
+        invalid_formats = conf.keys.select { |k|
+          m = k.match(/^format(\d+)$/)
+          m ? !((1..FORMAT_MAX_NUM).include?(m[1].to_i)) : false
+        }
+        unless invalid_formats.empty?
+          raise ConfigError, "Invalid formatN found. N should be 1 - #{FORMAT_MAX_NUM}: " + invalid_formats.join(",")
+        end
+      end
+
+      def check_format_regexp(format, key)
+        if format[0] == '/' && format[-1] == '/'
+          begin
+            Regexp.new(format[1..-2], Regexp::MULTILINE)
+          rescue => e
+            raise ConfigError, "Invalid regexp in #{key}: #{e}"
+          end
+        else
+          raise ConfigError, "format should be Regexp, need //, in #{key}: '#{format}'"
+        end
+      end
+    end
+  end
+end

data/lib/fluent/plugin/parser_nginx.rb

@@ -0,0 +1,24 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+
+Fluent::Plugin.register_parser('nginx', Proc.new {
+  Fluent::Plugin::RegexpParser.new(
+    /^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$/,
+    {'time_format'=>"%d/%b/%Y:%H:%M:%S %z"}
+  )
+})

data/lib/fluent/plugin/parser_none.rb

@@ -0,0 +1,36 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+
+require 'fluent/time'
+
+module Fluent
+  module Plugin
+    class NoneParser < Parser
+      Plugin.register_parser('none', self)
+
+      config_param :message_key, :string, default: 'message'
+
+      def parse(text)
+        record = {}
+        record[@message_key] = text
+        time = @estimate_current_event ? Fluent::EventTime.now : nil
+        yield time, record
+      end
+    end
+  end
+end

data/lib/fluent/plugin/parser_syslog.rb

@@ -0,0 +1,82 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+
+require 'fluent/time'
+
+module Fluent
+  module Plugin
+    class SyslogParser < Parser
+      Plugin.register_parser('syslog', self)
+
+      # From existence TextParser pattern
+      REGEXP = /^(?<time>[^ ]*\s*[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/
+      # From in_syslog default pattern
+      REGEXP_WITH_PRI = /^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$/
+
+      config_param :time_format, :string, default: "%b %d %H:%M:%S"
+      config_param :with_priority, :bool, default: false
+
+      def initialize
+        super
+        @mutex = Mutex.new
+      end
+
+      def configure(conf)
+        super
+
+        @regexp = @with_priority ? REGEXP_WITH_PRI : REGEXP
+        @time_parser = TimeParser.new(@time_format)
+      end
+
+      def patterns
+        {'format' => @regexp, 'time_format' => @time_format}
+      end
+
+      def parse(text)
+        m = @regexp.match(text)
+        unless m
+          yield nil, nil
+          return
+        end
+
+        time = nil
+        record = {}
+
+        m.names.each { |name|
+          if value = m[name]
+            case name
+            when "pri"
+              record['pri'] = value.to_i
+            when "time"
+              time = @mutex.synchronize { @time_parser.parse(value.gsub(/ +/, ' ')) }
+              record[name] = value if @keep_time_key
+            else
+              record[name] = value
+            end
+          end
+        }
+
+        if @estimate_current_event
+          time ||= Fluent::EventTime.now
+        end
+
+        yield time, record
+      end
+    end
+  end
+end

data/lib/fluent/plugin/parser_tsv.rb

@@ -0,0 +1,37 @@
+#
+# Fluentd
+#
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
+#
+
+require 'fluent/plugin/parser'
+require 'fluent/time'
+
+module Fluent
+  module Plugin
+    class TSVParser < ValuesParser
+      Plugin.register_parser('tsv', self)
+
+      config_param :delimiter, :string, default: "\t"
+
+      def configure(conf)
+        super
+        @key_num = @keys.length
+      end
+
+      def parse(text)
+        yield values_map(text.split(@delimiter, @key_num))
+      end
+    end
+  end
+end

data/lib/fluent/plugin/socket_util.rb

@@ -19,144 +19,150 @@ require 'ipaddr'
 require 'cool.io'
 
 require 'fluent/plugin'
+require 'fluent/input'
 
 module Fluent
-  module SocketUtil
-    def create_udp_socket(host)
-      if IPAddr.new(IPSocket.getaddress(host)).ipv4?
-        UDPSocket.new
-      else
-        UDPSocket.new(Socket::AF_INET6)
-      end
-    end
-    module_function :create_udp_socket
-
-    class UdpHandler < Coolio::IO
-      def initialize(io, log, body_size_limit, callback, resolve_hostname = false)
-        super(io)
-        @io = io
-        @io.do_not_reverse_lookup = !resolve_hostname
-        @log = log
-        @body_size_limit = body_size_limit
-        @callback = callback
+  module Plugin
+    module SocketUtil
+      def create_udp_socket(host)
+        if IPAddr.new(IPSocket.getaddress(host)).ipv4?
+          UDPSocket.new
+        else
+          UDPSocket.new(Socket::AF_INET6)
+        end
       end
+      module_function :create_udp_socket
+
+      class UdpHandler < Coolio::IO
+        def initialize(io, log, body_size_limit, callback)
+          super(io)
+          @io = io
+          @log = log
+          @body_size_limit = body_size_limit
+          @callback = callback
+        end
 
-      def on_readable
-        msg, addr = @io.recvfrom_nonblock(@body_size_limit)
-        msg.chomp!
-        @callback.call(msg, addr)
-      rescue => e
-        @log.error "unexpected error", error: e, error_class: e.class
+        def on_readable
+          msg, addr = @io.recvfrom_nonblock(@body_size_limit)
+          msg.chomp!
+          @callback.call(msg, addr)
+        rescue => e
+          @log.error "unexpected error", error: e
+        end
       end
-    end
 
-    class TcpHandler < Coolio::Socket
-      PEERADDR_FAILED = ["?", "?", "name resolusion failed", "?"]
+      class TcpHandler < Coolio::Socket
+        PEERADDR_FAILED = ["?", "?", "name resolusion failed", "?"]
 
-      def initialize(io, log, delimiter, callback, resolve_hostname = false)
-        super(io)
-        if io.is_a?(TCPSocket)
-          io.do_not_reverse_lookup = resolve_hostname
-          @addr = (io.peeraddr rescue PEERADDR_FAILED)
+        def initialize(io, log, delimiter, callback)
+          super(io)
+          @timeout = 0
+          if io.is_a?(TCPSocket)
+            @addr = (io.peeraddr rescue PEERADDR_FAILED)
 
-          opt = [1, @timeout.to_i].pack('I!I!')  # { int l_onoff; int l_linger; }
-          io.setsockopt(Socket::SOL_SOCKET, Socket::SO_LINGER, opt)
+            opt = [1, @timeout.to_i].pack('I!I!')  # { int l_onoff; int l_linger; }
+            io.setsockopt(Socket::SOL_SOCKET, Socket::SO_LINGER, opt)
+          end
+          @delimiter = delimiter
+          @callback = callback
+          @log = log
+          @log.trace { "accepted fluent socket object_id=#{self.object_id}" }
+          @buffer = "".force_encoding('ASCII-8BIT')
         end
-        @delimiter = delimiter
-        @callback = callback
-        @log = log
-        @log.trace { "accepted fluent socket object_id=#{self.object_id}" }
-        @buffer = "".force_encoding('ASCII-8BIT')
-      end
 
-      def on_connect
-      end
+        def on_connect
+        end
 
-      def on_read(data)
-        @buffer << data
-        pos = 0
+        def on_read(data)
+          @buffer << data
+          pos = 0
 
-        while i = @buffer.index(@delimiter, pos)
-          msg = @buffer[pos...i]
-          @callback.call(msg, @addr)
-          pos = i + @delimiter.length
+          while i = @buffer.index(@delimiter, pos)
+            msg = @buffer[pos...i]
+            @callback.call(msg, @addr)
+            pos = i + @delimiter.length
+          end
+          @buffer.slice!(0, pos) if pos > 0
+        rescue => e
+          @log.error "unexpected error", error: e
+          close
         end
-        @buffer.slice!(0, pos) if pos > 0
-      rescue => e
-        @log.error "unexpected error", error: e, error_class: e.class
-        close
-      end
 
-      def on_close
-        @log.trace { "closed fluent socket object_id=#{self.object_id}" }
+        def on_close
+          @log.trace { "closed fluent socket object_id=#{self.object_id}" }
+        end
       end
-    end
 
-    class BaseInput < Fluent::Input
-      def initialize
-        super
-        require 'fluent/parser'
-      end
+      class BaseInput < Fluent::Input
+        def initialize
+          super
+          require 'fluent/parser'
+        end
 
-      desc 'Tag of output events.'
-      config_param :tag, :string
-      desc 'The format of the payload.'
-      config_param :format, :string
-      desc 'The port to listen to.'
-      config_param :port, :integer, default: 5150
-      desc 'The bind address to listen to.'
-      config_param :bind, :string, default: '0.0.0.0'
-      desc "Deprecated parameter. Use source_hostname_key instead"
-      config_param :source_host_key, :string, default: nil, deprecated: "Use source_hostname_key instead"
-      desc "The field name of the client's hostname."
-      config_param :source_hostname_key, :string, default: nil
-      config_param :blocking_timeout, :time, default: 0.5
-
-      def configure(conf)
-        super
-
-        @source_hostname_key = @source_host_key if @source_host_key
-        @parser = Plugin.new_parser(@format)
-        @parser.configure(conf)
-      end
+        desc 'Tag of output events.'
+        config_param :tag, :string
+        desc 'The format of the payload.'
+        config_param :format, :string
+        desc 'The port to listen to.'
+        config_param :port, :integer, default: 5150
+        desc 'The bind address to listen to.'
+        config_param :bind, :string, default: '0.0.0.0'
+        desc "The field name of the client's hostname."
+        config_param :source_host_key, :string, default: nil
+        config_param :blocking_timeout, :time, default: 0.5
+
+        def configure(conf)
+          super
+
+          @parser = Plugin.new_parser(@format)
+          @parser.configure(conf)
+        end
 
-      def start
-        @loop = Coolio::Loop.new
-        @handler = listen(method(:on_message))
-        @loop.attach(@handler)
-        @thread = Thread.new(&method(:run))
-      end
+        def start
+          super
 
-      def shutdown
-        @loop.watchers.each { |w| w.detach }
-        @loop.stop
-        @handler.close
-        @thread.join
-      end
+          @loop = Coolio::Loop.new
+          @handler = listen(method(:on_message))
+          @loop.attach(@handler)
+          @thread = Thread.new(&method(:run))
+        end
 
-      def run
-        @loop.run(@blocking_timeout)
-      rescue => e
-        log.error "unexpected error", error: e, error_class: e.class
-        log.error_backtrace
-      end
+        def shutdown
+          @loop.watchers.each { |w| w.detach }
+          @loop.stop if @loop.instance_variable_get("@running")
+          @handler.close
+          @thread.join
 
-      private
+          super
+        end
 
-      def on_message(msg, addr)
-        @parser.parse(msg) { |time, record|
-          unless time && record
-            log.warn "pattern not match: #{msg.inspect}"
-            return
-          end
+        def run
+          @loop.run(@blocking_timeout)
+        rescue => e
+          log.error "unexpected error", error: e
+          log.error_backtrace
+        end
 
-          record[@source_hostname_key] = addr[2] if @source_hostname_key
-          router.emit(@tag, time, record)
-        }
-      rescue => e
-        log.error msg.dump, error: e, error_class: e.class, host: addr[3]
-        log.error_backtrace
+        private
+
+        def on_message(msg, addr)
+          @parser.parse(msg) { |time, record|
+            unless time && record
+              log.warn "pattern not match: #{msg.inspect}"
+              return
+            end
+
+            record[@source_host_key] = addr[3] if @source_host_key
+            router.emit(@tag, time, record)
+          }
+        rescue => e
+          log.error msg.dump, error: e, host: addr[3]
+          log.error_backtrace
+        end
       end
     end
   end
+
+  # obsolete
+  SocketUtil = Fluent::Plugin::SocketUtil
 end