1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
include vector
$content = @(END)
[sources.tcp]
type = "socket"
address = "0.0.0.0:9000"
mode = "tcp"
[transforms.parse]
type = "remap"
inputs = ["tcp"]
source = '''
stuff = del(.)
.message = stuff.message
.timestamp = stuff.timestamp
syslog, err_syslog = parse_syslog(.message)
if err_syslog != null {
json, err_json = parse_json(.message)
if err_json == null {
.json = json
}
} else {
.syslog = syslog
}
'''
[sinks.output]
type = "console"
inputs = ["parse"]
target = "stdout"
[sinks.output.encoding]
codec = "json"
| END
vector::configfile { 'vector1':
content => $content,
format => 'toml',
}
vector::sink { 'file':
type => file,
inputs => ['tcp'],
parameters => {
path => '/tmp/test.ndjson',
},
}
|
