From 55e826b3271d6fa49c024621a88997ffd1e3056f Mon Sep 17 00:00:00 2001 From: Daniel Berteaud Date: Tue, 26 Mar 2019 08:38:55 +0100 Subject: [PATCH] We can use a custom separator for structured messages --- systemd-journal-gelf | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/systemd-journal-gelf b/systemd-journal-gelf index c5a6335..4afd910 100644 --- a/systemd-journal-gelf +++ b/systemd-journal-gelf @@ -115,11 +115,19 @@ while ( my $entry = ){ level => $msg->{PRIORITY} }; - # Now lets look at the message. If it starts with gelf: we can split it and have further - # fields to send. I use this to handle httpd or nginx logs for example - if ( $msg->{MESSAGE} =~ m/^gelf:([a-zA-Z\d]+=([^\|])\|?)+/ ){ - $msg->{MESSAGE} =~ s/^gelf://; - foreach ( split /\|/, $msg->{MESSAGE} ){ + # Now lets look at the message. If it starts with gelf: or gelf(): + # we can split it and have further fields to send. + # I use this to handle httpd or nginx logs for example + # If separator is not specified, the default is | eg + # gelf:code=200|url=/index.html|remote_ip=10.99.5.12|referer=http://test.local/ + # + # OR + # + # gelf(~):code=200~url=/index.html~remote_ip=10.99.5.12~referer=http://test.local/ + if ( $msg->{MESSAGE} =~ m/^gelf(\([^\(\)]+\))?:([a-zA-Z\d]+=([^\|])\|?)+/ ){ + $msg->{MESSAGE} =~ s/^gelf(\([^\(\)]+\))?://; + my $separator = ($1 && length $1 > 0) ? qr{$1} : qr{\|}; + foreach ( split /$separator/, $msg->{MESSAGE} ){ my ( $key, $val ) = split /=/, $_; $gelf->{'_' . lc $key} = $val; }