Return-Path: X-Original-To: apmail-flume-user-archive@www.apache.org Delivered-To: apmail-flume-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 4C0E217B1D for ; Thu, 16 Oct 2014 06:42:45 +0000 (UTC) Received: (qmail 95238 invoked by uid 500); 16 Oct 2014 06:42:45 -0000 Delivered-To: apmail-flume-user-archive@flume.apache.org Received: (qmail 95184 invoked by uid 500); 16 Oct 2014 06:42:44 -0000 Mailing-List: contact user-help@flume.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@flume.apache.org Delivered-To: mailing list user@flume.apache.org Received: (qmail 95174 invoked by uid 99); 16 Oct 2014 06:42:44 -0000 Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 16 Oct 2014 06:42:44 +0000 X-ASF-Spam-Status: No, hits=1.5 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of sharninder@gmail.com designates 209.85.212.182 as permitted sender) Received: from [209.85.212.182] (HELO mail-wi0-f182.google.com) (209.85.212.182) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 16 Oct 2014 06:42:19 +0000 Received: by mail-wi0-f182.google.com with SMTP id n3so3751472wiv.15 for ; Wed, 15 Oct 2014 23:42:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=TBCjniUn8I9B8NRdICYJDLo5V57WOSjG7trk1UbSKHQ=; b=VTf9t+HhTBD2EHiWKGVMsDUuaBitpF6nbewCjxsGditDMkLD++tFs7vGCFmg25Na81 6ROhAhf8Z4u0ECOmSR7p7i5fCJl/Qp3kPMsZo7CrpLGsRapxKT98m2820oz0hYBjfu2+ vRozHerDtAXaATE3tka7tiGbIqSCexOCzBVx43/3UkMSoOqPGwDtptPpGT7ZjFPi7ILR 0G9HS0InCvaNeTa99xldCUxze8VXLpavKjRQ8KAifQN1AxjpekUbj2xqarObzMcKJiKy 0f1xXKjDA/Eh+1FN0eYirKNWjLu6aRYGIOSz/hYZJWB4a5VRma3jnnqCYycQbtEvpPC8 ZAVg== MIME-Version: 1.0 X-Received: by 10.180.73.134 with SMTP id l6mr17565008wiv.14.1413441738630; Wed, 15 Oct 2014 23:42:18 -0700 (PDT) Received: by 10.194.60.68 with HTTP; Wed, 15 Oct 2014 23:42:18 -0700 (PDT) In-Reply-To: References: <1413434829172.0ad74266@Nodemailer> Date: Thu, 16 Oct 2014 12:12:18 +0530 Message-ID: Subject: Re: Flume Syslog source From: Sharninder To: "user@flume.apache.org" Content-Type: multipart/alternative; boundary=f46d043d673fbdeaba0505848c37 X-Virus-Checked: Checked by ClamAV on apache.org --f46d043d673fbdeaba0505848c37 Content-Type: text/plain; charset=ISO-8859-1 I just looked at the existing syslogtcp source and it seems it does take pains to parse the hostname from the message and I think that is the best bet for me. Ofcourse, it might fail for a few devices, but I'll just have to think of something else for those. -- Sharninder On Thu, Oct 16, 2014 at 10:40 AM, Sharninder wrote: > Yes Jeff. That's a possiblity but I'm not sure (actually pretty sure) that > there would be a some random device which will not send their logs in the > proper format and my regex will break. This is the way I'll implement it if > I can't find anything better. > > Thanks, > Sharninder > > > > On Thu, Oct 16, 2014 at 10:22 AM, Jeff Lord wrote: > >> You can also use a regex interceptor to extract hostname from the message >> (assuming it's there) and put that in an event header. From there you can >> route and create partitions with the header. >> >> >> On Wednesday, October 15, 2014, Hari Shreedharan < >> hshreedharan@cloudera.com> wrote: >> >>> The Multiport syslog source can add the port number on which the data >>> was received to the event headers. You can use with a multiplexing channel >>> selector to separate this to different channels. >>> >>> Thanks, >>> Hari >>> >>> >>> On Wed, Oct 15, 2014 at 9:45 PM, Sharninder >>> wrote: >>> >>>> Hi Guys, >>>> >>>> I'm trying to implement a system to archive syslogs using flume. I've >>>> played around with it a bit but haven't really been able to figure out a >>>> way to segregate logs according to the host they're coming from? Is there a >>>> way for me to add the hostname to the event header somehow? I can then use >>>> either an interceptor to read the header or even a custom sink to deal with >>>> events based on the hostname. >>>> >>>> -- >>>> Sharninder >>>> >>>> >>> > --f46d043d673fbdeaba0505848c37 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
I just looked at the existing syslogtcp source and it= seems it does take pains to parse the hostname from the message and I thin= k that is the best bet for me. Ofcourse, it might fail for a few devices, b= ut I'll just have to think of something else for those.

--=
Sharninder


On Thu, Oct 16, 2014 at 10:40 AM, Sharninder &= lt;sharninder@gma= il.com> wrote:
Yes Jeff. That's a possiblity but I'm not sure (actually = pretty sure) that there would be a some random device which will not send t= heir logs in the proper format and my regex will break. This is the way I&#= 39;ll implement it if I can't find anything better.

Thanks= ,
Sharninder

=A0

On Thu, Oct 16, 2014 at 10:22 AM, Jeff= Lord <jlord@cloudera.com> wrote:
You can also use a regex interceptor to extract hostname from the = message (assuming it's there) and put that in an event header. From the= re you can route and create partitions with the header.


On Wednesday, October 15, 2014, Hari Shreedharan <hshreedharan@cloudera.c= om> wrote:
The Multiport syslog source can add the port number on which the= data was received to the event headers. You can use with a multiplexing ch= annel selector to separate this to different channels.

Thanks,
Hari


On Wed, Oct 15, 2014 at 9:45 PM, Shar= ninder <sharninder@gmail.com> wrote:<= br>

Hi Guys,

I'm trying to implement a system to archive syslog= s using flume. I've played around with it a bit but haven't really = been able to figure out a way to segregate logs according to the host they&= #39;re coming from? Is there a way for me to add the hostname to the event = header somehow? I can then use either an interceptor to read the header or = even a custom sink to deal with events based on the hostname.

--
=
Sharninder




--f46d043d673fbdeaba0505848c37--