diff --git a/README.md b/README.md index 6f356b5..7b33cbc 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ Since TimberWinR only ships to Redis, the format generated by TimberWinR is JSON represented as a JSON Property or Array. ## Supported Output Formats - - Redis +1. [Redis](https://github.com/efontana/TimberWinR/blob/master/TimberWinR/mdocs/RedisOutput.md) ## Sample Configuration TimberWinR reads a JSON configuration file, an example file is shown here: diff --git a/TimberWinR.ServiceHost/config.json b/TimberWinR.ServiceHost/config.json index 23da196..4715fd9 100644 --- a/TimberWinR.ServiceHost/config.json +++ b/TimberWinR.ServiceHost/config.json @@ -10,18 +10,18 @@ ], "Tcp": [ { - "port": "5140" + "_comment": "Output from NLog", + "port": 5140 } ], "Logs": [ - { - "name": "Syslogs1", + { "location": "C:\\Logs1\\*.log" } ], "IISW3CLogs": [ { - "name": "Default site", + "_comment": "Default site", "location": "c:\\inetpub\\logs\\LogFiles\\W3SVC1\\*" } ] diff --git a/TimberWinR/Inputs/TcpInputListener.cs b/TimberWinR/Inputs/TcpInputListener.cs index da487aa..7ae6462 100644 --- a/TimberWinR/Inputs/TcpInputListener.cs +++ b/TimberWinR/Inputs/TcpInputListener.cs @@ -91,9 +91,14 @@ namespace TimberWinR.Inputs //message has successfully been received var encoder = new ASCIIEncoding(); var encodedMessage = encoder.GetString(message, 0, bytesRead); - - JObject json = JObject.Parse(encodedMessage); - ProcessJson(json); + try + { + JObject json = JObject.Parse(encodedMessage); + ProcessJson(json); + } + catch (Exception) + { + } } tcpClient.Close(); Finished(); diff --git a/TimberWinR/TimberWinR.csproj b/TimberWinR/TimberWinR.csproj index e6af7d8..fde2995 100644 --- a/TimberWinR/TimberWinR.csproj +++ b/TimberWinR/TimberWinR.csproj @@ -101,6 +101,7 @@ + diff --git a/TimberWinR/mdocs/IISW3CInput.md b/TimberWinR/mdocs/IISW3CInput.md index 2e62d3b..a150e19 100644 --- a/TimberWinR/mdocs/IISW3CInput.md +++ b/TimberWinR/mdocs/IISW3CInput.md @@ -11,10 +11,11 @@ If the logging configuration of an IIS virtual site is updated, the structure of ## Parameters -The following parameters are allowed when configuring WindowsEvents. +The following parameters are allowed when configuring IISW3CLogs input. | Parameter | Type | Description | Details | Default | | :---------------- |:---------------| :----------------------------------------------------------------------- | :--------------------------- | :-- | +| *location* | string |Location of log files(s) to monitor | Path to text file(s) including wildcards, may be separated by commas | | | *iCodepage* | integer |Codepage of the text file. | 0 is the system codepage, -1 is UNICODE. | 0 | | *recurse* | integer |Max subdirectory recursion level. | 0 disables subdirectory recursion; -1 enables unlimited recursion. | 0 | | *minDateMod* | datetime |Minimum file last modified date, in local time coordinates | When this parameter is specified, the IISW3C input format processes only log files that have been modified after the specified date. | | @@ -39,7 +40,7 @@ Example Input: ## Fields -After a successful parse of an event, the following fields are added [if configured to be logged](http://technet.microsoft.com/en-us/library/cc754702(v=ws.10).aspx) +After a successful parse of an event, the following fields are added [(if configured to be logged)](http://technet.microsoft.com/en-us/library/cc754702(v=ws.10).aspx) | Name | Type | Description | | ---- |:-----| :-----------------------------------------------------------------------| diff --git a/TimberWinR/mdocs/RedisOutput.md b/TimberWinR/mdocs/RedisOutput.md new file mode 100644 index 0000000..939431c --- /dev/null +++ b/TimberWinR/mdocs/RedisOutput.md @@ -0,0 +1,35 @@ +# Output: Redis + +The Redis output passes on data to Redis to be consumed by the Logtash indexer. + +## Parameters +The following parameters are allowed when configuring the Redis output. + +| Parameter | Type | Description | Details | Default | +| :-------------|:---------|:------------------------------------------------------------| :--------------------------- | :-- | +| *threads* | string | Location of log files(s) to monitor | Number of worker theads to send messages | 1 | +| *interval* | integer | Interval in milliseconds to sleep during batch sends | Interval | 5000 | +| *batch_count* | integer | The number of events to send in a single transaction | | 10 | +| *index* | string | The name of the redis list | logstash index name | logstash | +| *host* | [string] | The hostname(s) of your Redis server(s) | IP or DNS name | | +| *port* | integer | Redis port number | This port must be open | 6379 | + +Example Input: +```json +{ + "TimberWinR": { + "Outputs": { + "Redis": [ + { + "threads": 1, + "interval": 5000, + "batch_count": 500, + "host": [ + "tstlexiceapp006.vistaprint.svc" + ] + } + ] + } + } +} +``` \ No newline at end of file diff --git a/TimberWinR/mdocs/TcpInput.md b/TimberWinR/mdocs/TcpInput.md new file mode 100644 index 0000000..44d761f --- /dev/null +++ b/TimberWinR/mdocs/TcpInput.md @@ -0,0 +1,28 @@ +# Input: Tcp + +The Tcp input will open a port and listen for properly formatted JSON and will forward on the entire JSON. + +## Parameters +The following parameters are allowed when configuring the Tcp input. + +| Parameter | Type | Description | Details | Default | +| :---------------- |:---------------| :----------------------------------------------------------------------- | :--------------------------- | :-- | +| *port* | integer |Port number to open | Must be an available port | | + +Example Input: Monitors all files (recursively) located at C:\Logs1\ matching *.log as a pattern. I.e. C:\Logs1\foo.log, C:\Logs1\Subdir\Log2.log, etc. + +```json +{ + "TimberWinR": { + "Inputs": { + "Tcp": [ + { + "port": 5140 + } + ] + } + } +} +``` +## Fields +A field: "type": "Win32-Tcp" is automatically appended, and the entire JSON is passed on vertabim.