org.apache.flume.source
Class SyslogParser

java.lang.Object
  extended by org.apache.flume.source.SyslogParser

@InterfaceAudience.Private
@InterfaceStability.Evolving
public class SyslogParser
extends Object


Constructor Summary
SyslogParser()
           
 
Method Summary
 Event parseMessage(String msg, Charset charset, Set<String> keepFields)
          Parses a Flume Event out of a syslog message string.
protected  long parseRfc3164Time(String ts)
          Parse the RFC3164 date format.
protected  long parseRfc5424Date(String msg)
          Parse date in RFC 5424 format.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

SyslogParser

public SyslogParser()
Method Detail

parseMessage

public Event parseMessage(String msg,
                          Charset charset,
                          Set<String> keepFields)
Parses a Flume Event out of a syslog message string.

Parameters:
msg - Syslog message, not including the newline character
Returns:
Parsed Flume Event
Throws:
IllegalArgumentException - if unable to successfully parse message

parseRfc5424Date

protected long parseRfc5424Date(String msg)
Parse date in RFC 5424 format. Uses an LRU cache to speed up parsing for multiple messages that occur in the same second.

Parameters:
msg -
Returns:
Typical (for Java) milliseconds since UNIX epoch

parseRfc3164Time

protected long parseRfc3164Time(String ts)
Parse the RFC3164 date format. This is trickier than it sounds because this format does not specify a year so we get weird edge cases at year boundaries. This implementation tries to "do what I mean".

Parameters:
ts - RFC3164-compatible timestamp to be parsed
Returns:
Typical (for Java) milliseconds since the UNIX epoch


Copyright © 2009-2015 Apache Software Foundation. All Rights Reserved.