Skip to content
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pipeline/inputs/syslog.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ The plugin supports the following configuration parameters:
| Parser | Specify an alternative parser for the message. If _Mode_ is set to _tcp_ or _udp_ then the default parser is _syslog-rfc5424_ otherwise _syslog-rfc3164-local_ is used. If your syslog messages have fractional seconds set this Parser value to _syslog-rfc5424_ instead. | |
| Buffer\_Chunk\_Size | By default the buffer to store the incoming Syslog messages, do not allocate the maximum memory allowed, instead it allocate memory when is required. The rounds of allocations are set by _Buffer\_Chunk\_Size_. If not set, _Buffer\_Chunk\_Size_ is equal to 32000 bytes \(32KB\). Read considerations below when using _udp_ or _unix\_udp_ mode. | |
| Buffer\_Max\_Size | Specify the maximum buffer size to receive a Syslog message. If not set, the default size will be the value of _Buffer\_Chunk\_Size_. | |
| Encoding | Specify input character set (if not UTF-8). [Tail](tail.md#encoding) input plugin has more info. |

### Considerations

Expand Down
41 changes: 41 additions & 0 deletions pipeline/inputs/tail.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ The plugin supports the following configuration parameters:
| Key | When a message is unstructured \(no parser applied\), it's appended as a string under the key name _log_. This option allows to define an alternative name for that key. | log |
| Tag | Set a tag \(with regex-extract fields\) that will be placed on lines read. E.g. `kube.<namespace_name>.<pod_name>.<container_name>`. Note that "tag expansion" is supported: if the tag includes an asterisk \(\*\), that asterisk will be replaced with the absolute path of the monitored file \(also see [Workflow of Tail + Kubernetes Filter](../filters/kubernetes.md#workflow-of-tail-kubernetes-filter)\). | |
| Tag\_Regex | Set a regex to exctract fields from the file. E.g. `(?<pod_name>[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)_(?<namespace_name>[^_]+)_(?<container_name>.+)-` | |
| Encoding | Specify input character set (if not UTF-8). [more](#encoding) | |

Note that if the database parameter `DB` is **not** specified, by default the plugin will start reading each target file from the beginning.

Expand Down Expand Up @@ -119,3 +120,43 @@ File rotation is properly handled, including logrotate's _copytruncate_ mode.

Note that the `Path` patterns **cannot** match the rotated files. Otherwise, the rotated file would be read again and lead to duplicate records.


## Encoding

Tail input plugin supports also common 8-bit character encodings:

```
windows-1250, windows-1251, windows-1252,
windows-1253, windows-1254, windows-1255,
windows-1256, windows-1257, windows-1258,

iso-8859-1, iso-8859-2, iso-8859-3, iso-8859-4,
iso-8859-5, iso-8859-6, iso-8859-7, iso-8859-8,
iso-8859-9, iso-8859-10, iso-8859-11, iso-8859-13,
iso-8859-14, iso-8859-15, iso-8859-16
```

By default encoding fails if there are invalid characters in input . With //... postfix character behaviour can be changed.

| Encoding | Description |
| :--- | :--- |
| _ENCODING_ | fail if bad characters |
| _ENCODING_//IGNORE | skip bad characters |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, still going with the //MODE iconv approach, but why? I think simply specifying the (possibly empty or NULL) replacement string for bad characters suffices for this, no need for iconv baggage.

| _ENCODING_//REPLACEMENT | replace bad characters with unicode 0xFFFD (REPLACEMENT CHARACTER) |
| _ENCODING_//QUESTION | replace bad characters with '?' |
| _ENCODING_///**customstr** | replace bad characters with **customstr**


Example:

```python
[INPUT]
Name tail
...
Encoding windows-1252//REPLACEMENT

```