org.apache.flume.source
Class SyslogParser

java.lang.Object
  org.apache.flume.source.SyslogParser

@InterfaceAudience.Private
@InterfaceStability.Evolving
public class SyslogParser
extends Object

Constructor Summary

SyslogParser()

Method Summary

Event	parseMessage(String msg, Charset charset, Set<String> keepFields) Parses a Flume Event out of a syslog message string.
protected long	parseRfc3164Time(String ts) Parse the RFC3164 date format.
protected long	parseRfc5424Date(String msg) Parse date in RFC 5424 format.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SyslogParser

public SyslogParser()

Method Detail

parseMessage

public Event parseMessage(String msg,
                          Charset charset,
                          Set<String> keepFields)

Parses a Flume Event out of a syslog message string.

Parameters:

msg - Syslog message, not including the newline character

Returns:

Parsed Flume Event

Throws:

IllegalArgumentException - if unable to successfully parse message

parseRfc5424Date

protected long parseRfc5424Date(String msg)

Parse date in RFC 5424 format. Uses an LRU cache to speed up parsing for multiple messages that occur in the same second.

Parameters:

msg -

Returns:

Typical (for Java) milliseconds since UNIX epoch

parseRfc3164Time

protected long parseRfc3164Time(String ts)

Parse the RFC3164 date format. This is trickier than it sounds because this format does not specify a year so we get weird edge cases at year boundaries. This implementation tries to "do what I mean".

Parameters:

ts - RFC3164-compatible timestamp to be parsed

Returns:

Typical (for Java) milliseconds since the UNIX epoch