| # Syslog Format Plugin |
| This format plugin enables Drill to query syslog formatted data as specified in RFC-5424, as shown below. |
| |
| ``` |
| <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"] |
| ``` |
| |
| ## Configuration Options |
| This format pluin has the following configuration options: |
| |
| * **`maxErrors`**: Sets the maximum number of malformatted lines that the format plugin will tolerate before throwing an error and halting execution |
| * **`flattenStructuredData`**: Syslog data optionally contains a series of key/value pairs known as the structured data. By default, Drill will parse these into a `map`. |
| |
| ``` |
| "syslog": { |
| "type": "syslog", |
| "extensions": [ "syslog" ], |
| "maxErrors": 10, |
| "flattenStructuredData": false |
| } |
| ``` |
| |
| ## Fields |
| Since the structure of the data contained in a syslog is well known. In terms of data types, the `event_date` field is a datetime, the `severity_code`, `facility_code`, and `proc_id` are integers and all other fields are VARCHARs. |
| |
| ** Note: All fields, with the exception of the `event_date`, are not required, so not all fields may be present at all times. ** |
| |
| * `event_date`: This is the time of the event |
| * `severity_code`: The severity code of the event |
| * `facility_code`: The facility code of the incident |
| * `severity`: The severity of the event |
| * `facility`: |
| * `ip`: The IP address or hostname of the source machine |
| * `app_name`: The name of the application that is generating the event |
| * `proc_id`: The process ID of the event that generated the event |
| * `msg_id`: The identifier of the message |
| * `message`: The actual message text of the event |
| * `_raw`: The full text of the event |
| |
| ### Structured Data |
| Syslog data can contain a list of key/value pairs which Drill will extract in a field called `structured_data`. This field is a Drill Map. |
