Hi all,
I'm trying to setup two hekad instances, one instance forward syslog
messages to the other using tcp input/output.
The sender instance config is as follows:
[dashboard_output]
type = 'DashboardOutput'
address = '0.0.0.0:4352'
ticker_interval = 10
[tcp_output]
message_matcher = 'Type == "logfile"'
address = 'server2:8888'
type = 'TcpOutput'
[debug_output]
message_matcher = 'Type == "logfile"'
type = 'LogOutput'
encoder = 'rst_encoder'
[rsyslog_decoder]
type = 'SandboxDecoder'
filename = 'lua_modules/decoders/rsyslog.lua'
[rsyslog_decoder.config]
tz = 'Europe/Paris'
template = '%timestamp% %hostname% %syslogseverity-text% %app-name% %msg%\n'
hostname_keep = true
[syslog]
log_directory = '/var/log'
type = 'LogstreamerInput'
file_match = 'syslog'
decoder = 'rsyslog_decoder'
End the receiver instance config looks like:
[tcp]
address = '0.0.0.0:8888'
type = 'TcpInput'
[rst_encoder]
type = 'RstEncoder'
[dashboard_output]
type = 'DashboardOutput'
address = '0.0.0.0:4352'
ticker_interval = 10
[debug_output]
message_matcher = 'TRUE'
type = 'LogOutput'
encoder = 'rst_encoder'
The problem is that on the debug output, I don't see the same things in
both end.
On the sender side, I get something like:
2015/04/28 12:53:05
:Timestamp: 2015-04-28 10:51:01 +0000 UTC
:Type: logfile
:Hostname: server1
:Pid: 0
:Uuid: 8d6f9424-7866-438b-a8b8-a646d41a2b2e
:Logger: syslog
:Payload: (root) CMD (/usr/local/rtm/bin/rtm 35 > /dev/null 2> /dev/null)
:EnvVersion:
:Severity: 6
:Fields:
| name:"hostname" type:string value:"server1"
| name:"app-name" type:string value:"CRON"
While on the receiver side, I get:
2015/04/28 12:53:05
:Timestamp: 2015-04-28 12:51:01 +0000 UTC
:Type:
:Hostname:
:Pid: 0
:Uuid: 8d6f9424-7866-438b-a8b8-a646d41a2b2e
:Logger:
:Payload: (root) CMD (/usr/local/rtm/bin/rtm 35 > /dev/null 2> /dev/null)
:EnvVersion:
:Severity: 6
:Fields:
| name:"hostname" type:string value:"server1"
| name:"app-name" type:string value:"CRON"
On the receiver side, some fields are missing (Type, Logger, Hostname), and
the timestamp is wrong.
Any idea ? Or maybe this is the expected beahviour ?
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
