Skip to content

suretec/Message-Passing-Output-ElasticSearch

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

27 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

NAME
    Message::Passing::Output::ElasticSearch - output logstash messages into
    ElasticSearch.

SYNOPSIS
        message-pass --input STDIN --output ElasticSearch --output_options '{"elasticsearch_servers": ["localhost:9200", "192.0.2.29:9200"]}'

DESCRIPTION
    Currently this output stores messages in the logstash format:

    index
        one index per day in the format logstash-YYYY.MM.dd

    type
        Is taken from the '__CLASS__' attribute or set to 'unknown' if not
        defined. If is also stored in the @type field.

    id  Is takes from the 'uuid' attribute or autogenerated by
        ElasticSearch.

    @timestamp
        The datetime is taken from the message epochtime or date attribute.

        The epochtime attribute is expected in seconds since 1.1.1970 00:00
        UTC.

        The date attribute is expected to be a string in ISO8601 format.

        If both are missing the current timestamp is used. It is used to
        determine the index as well as stored in the @timestamp field.

    @tags
        Is set to an empty list.

    @source_host
        Is takes from the message hostname attribute or set to 'none' if not
        defined.

    @message
        Is taken from the 'message' attribute or the whole message gets JSON
        encoded.

    @fields
        Is set to all not otherwise processed message attributes.

METHODS
  elasticsearch_servers
    A required attribute for the ElasticSearch server FQDNs or IP addresses
    including the port which normally is 9200.

  verbose
    A boolean attribute that defaults to true if STDIN is opened to a tty.

  consume ($msg)
    Consumes a message, queuing it for consumption by ElasticSearch. The
    message has to be a hashref.

SEE ALSO
    Message::Passing
    <http://logstash.net>

AUTHOR
    Tomas (t0m) Doran <[email protected]>

COPYRIGHT
LICENSE
    This is free software; you can redistribute it and/or modify it under
    the same terms as the Perl 5 programming language system itself.

About

Message-Passing-Output-ElasticSearch

Resources

Stars

Watchers

Forks

Packages

No packages published

Contributors 4

  •  
  •  
  •  
  •  

Languages