-
Notifications
You must be signed in to change notification settings - Fork 11
Structure of an event
An event is essentially a Map, but with added elements to better fit LogHub usage.
Any map entry can be access in LogHub's DSL using [key]. If the value is a map, keys can be chained, using a very simple syntax: [key1 key2].
Each event store a timestamp, that can be accessed using the syntax [ @timestamp ]. It's a java.util.Date object.
Each event can be decorated with some meta, that will usually not send to simple Encoder like String or terminal sender like Elastic. High level serializer like Msgpack will send them.
Values can be accessed in the DLS by prefixing the name value with a #: [#key].
Each receiver create a custom context that stores specific information for this receiver like IP address for network-based socket. It's access using [@context]. The context is never serialised in senders.
For example, if the receiver use a TCP socket, [@context localAddress] will return a java.net.InetSocketAddress for the local endpoint of the connexion. The remote part can be accessed through [@context remoteAddress .
Getter can be accessed using standard bean conventions: java.net.InetSocketAddress#getAddress for the remote endpoint will be accessed using [@context remoteAddress address].
When SSL/TLS was used, the whole sessions settings can be access through [@context sslParameters]
If the connexion is authenticated, this context also provides authentication information in a java.security.Principal object. Once again, bean conventions are used: java.security.Principal#getName is read using [@context principal name]
Defined when a processor generated an ProcessorException, it will contain the error message, only accessible from exception pipeline of a processor.
Value can be access used the syntax [@lastException].