1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
java destination
================
java destination gives an abstract class to implement destinations based on Java
If you want to implement a java destination, you should extend SyslogNgDestination abstract class
which is contained by the syslog-ng-core.jar which jar file will be in the moduledir after make install
Example implementation of a dummy destination
```
import org.syslog_ng.*;
public class TestClass extends TextLogDestination {
public TestClass(long handle) {
super(handle);
}
public boolean init()
{
System.out.println("START");
System.out.println("Initialize test destination");
return true;
}
public void deinit()
{
System.out.println("Deinitialize object");
}
public boolean queue(String message)
{
System.out.println("This is queue!" + message);
return true;
}
public boolean flush()
{
return true;
}
}
```
You need compile your written java based destination to create a .class or a .jar file
```
javac -cp /usr/lib/syslog-ng/syslog-ng-core.jar TestClass.java
```
You have to set the path of the class file or the name of the jar file (with full path) in the syslog-ng config
Example configuration for this (if you compiled the java file above, and the class file is in the /tmp directory):
```
@version: 3.19
options {
threaded(yes);
};
source s_tcp{
tcp(
port(5555)
);
};
destination d_java{
java(
class_name("TestClass")
class_path("/tmp")
option("key", "value")
);
};
log{
source(s_tcp);
destination(d_java);
flags(flow-control);
};
```
Example configuration using jar files in the class_path (the path inside the jar file has to been set using '.'):
```
@version: 3.19
options {
threaded(yes);
};
source s_local {
internal();
};
source s_network {
tcp(port(5555));
};
destination d_local {
java(
class_path("/usr/lib/syslog-ng/3.6/elasticsearch.jar:/usr/share/elasticsearch/lib/elasticsearch-1.4.0.jar:/usr/share/elasticsearch/lib/lucene-core-4.10.2.jar")
class_name("org.syslog_ng.destinations.ElasticSearch")
template("$(format-json --scope rfc5424 --exclude DATE --key ISODATE)")
option("cluster" "cl1")
option("index" "syslog")
option("type" "test")
option("server" "192.168.1.104")
option("port" "9300")
);
};
log {
source(s_network);
destination(d_local);
flags(flow-control);
};
```
Trouble shooting
----------------
### Set library path
If you want to use the syslog-ng java destination you have to add the path of the libjvm.so to the LD_LIBRARY_PATH
so if you get the following error, it means, that the LD_LIBRARY_PATH does not contain the path of libjvm and you have to set it:
```
Error opening plugin module; module='mod-java', error='libjvm.so: cannot open shared object file: No such file or directory'
```
|
