org.apache.flume.sink.elasticsearch
Class ElasticSearchLogStashEventSerializer

java.lang.Object
  extended by org.apache.flume.sink.elasticsearch.ElasticSearchLogStashEventSerializer
All Implemented Interfaces:
Configurable, ConfigurableComponent, ElasticSearchEventSerializer

public class ElasticSearchLogStashEventSerializer
extends Object
implements ElasticSearchEventSerializer

Serialize flume events into the same format LogStash uses

This can be used to send events to ElasticSearch and use clients such as Kabana which expect Logstash formated indexes
 {
    "@timestamp": "2010-12-21T21:48:33.309258Z",
    "@tags": [ "array", "of", "tags" ],
    "@type": "string",
    "@source": "source of the event, usually a URL."
    "@source_host": ""
    "@source_path": ""
    "@fields":{
       # a set of fields for this event
       "user": "jordan",
       "command": "shutdown -r":
     }
     "@message": "the original plain-text message"
   }
 
If the following headers are present, they will map to the above logstash output as long as the logstash fields are not already present.

  timestamp: long -> @timestamp:Date
  host: String -> @source_host: String
  src_path: String -> @source_path: String
  type: String -> @type: String
  source: String -> @source: String
 

See Also:
://github.com/logstash/logstash/wiki/logstash%27s-internal-message- format

Field Summary
 
Fields inherited from interface org.apache.flume.sink.elasticsearch.ElasticSearchEventSerializer
charset
 
Constructor Summary
ElasticSearchLogStashEventSerializer()
           
 
Method Summary
 void configure(ComponentConfiguration conf)
           
 void configure(Context context)
           Request the implementing class to (re)configure itself.
 org.elasticsearch.common.xcontent.XContentBuilder getContentBuilder(Event event)
          Return an XContentBuilder made up of the serialized flume event
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

ElasticSearchLogStashEventSerializer

public ElasticSearchLogStashEventSerializer()
Method Detail

getContentBuilder

public org.elasticsearch.common.xcontent.XContentBuilder getContentBuilder(Event event)
                                                                    throws IOException
Description copied from interface: ElasticSearchEventSerializer
Return an XContentBuilder made up of the serialized flume event

Specified by:
getContentBuilder in interface ElasticSearchEventSerializer
Parameters:
event - The flume event to serialize
Returns:
A XContentBuilder used to write to ElasticSearch
Throws:
IOException - If an error occurs during serialization

configure

public void configure(Context context)
Description copied from interface: Configurable

Request the implementing class to (re)configure itself.

When configuration parameters are changed, they must be reflected by the component asap.

There are no thread safety guarrantees on when configure might be called.

Specified by:
configure in interface Configurable

configure

public void configure(ComponentConfiguration conf)
Specified by:
configure in interface ConfigurableComponent


Copyright © 2009-2012 Apache Software Foundation. All Rights Reserved.