Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TCP input with parsers #31023

Closed
4 tasks done
Tracked by #26130
jlind23 opened this issue Mar 28, 2022 · 2 comments
Closed
4 tasks done
Tracked by #26130

TCP input with parsers #31023

jlind23 opened this issue Mar 28, 2022 · 2 comments
Labels
Stalled Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Comments

@jlind23
Copy link
Collaborator

jlind23 commented Mar 28, 2022

Goal

Parsers are the successors of readers of the log input. They provide a more flexible message parsing. At the moment they are only available in the filestream input. But the functionality could be useful in other inputs.

We have to inspect all available inputs in Filebeat to see if it makes sense to add parsers. If the answer is yes, then the feature should be added.

Parsers

How to add parsers to an input

1. Add parsers code to the input

The parser.Config object has its own Unpack function, so it is enough for you to add it as an attribute to your configuration.

type myInputConfiguration struct {
   // other attributes
    parsers parser.Config `config:",inline"`
}

Then create the parser based on the configuration. The Create function expects a reader.Reader as a parameter it can read from.

var reader reader.Reader
p = inp.config.parsers.Create(reader)

Example configuration accepted by the code above

parsers:
  - multiline:
      type: count
      lines_count: 3

2. Add parsers to the reference configuration

Add the reference configuration to either

  • filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl
  • x-pack/filebeat/_meta/config/filebeat.inputs.reference.yml.tmpl

3. Add parsers to the documentation of the input

There is no common parsers section at the moment because it might not make sense to document all parsers for every input.

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Mar 28, 2022
@jlind23 jlind23 added Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team 8.4-candidate and removed needs_team Indicates that the issue/PR needs a Team:* label labels Mar 28, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@botelastic
Copy link

botelastic bot commented Jul 7, 2023

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

@botelastic botelastic bot added the Stalled label Jul 7, 2023
@botelastic botelastic bot closed this as completed Jan 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Stalled Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team
Projects
None yet
Development

No branches or pull requests

2 participants