Compare commits
6 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
5165224c65 | ||
|
|
fd9306e24e | ||
|
|
050ae7cf84 | ||
|
|
a99b04e1b1 | ||
|
|
dddbf6ae0d | ||
|
|
147e243478 |
50
README.md
50
README.md
@@ -2,6 +2,14 @@ TimberWinR
|
||||
==========
|
||||
A Native Windows to Redis/Elasticsearch Logstash Agent which runs as a service.
|
||||
|
||||
## Development and Roadmap
|
||||
|
||||
TimberWinR's development has been and in the short term will continue to be on a hiatus. The project's ownership has been recently transferred, and thus the project will be slow to pick up steam again. Currently a roadmap is being established, and a vision for the project is currently being formulated.
|
||||
|
||||
#### Getting Involved
|
||||
|
||||
If you wish to be involved with TimberWinR in an on-going basis file an issue.
|
||||
|
||||
## Why have TimberWinR?
|
||||
TimberWinR is a native .NET implementation utilizing Microsoft's [LogParser](http://technet.microsoft.com/en-us/scriptcenter/dd919274.aspx). This means
|
||||
no JVM/JRuby is required, and LogParser does all the heavy lifting. TimberWinR collects
|
||||
@@ -9,7 +17,7 @@ the data from LogParser and ships it to Logstash via Redis (or can ship direcly
|
||||
|
||||
## Release Notes
|
||||
|
||||
[View Version History](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/ReleaseNotes.md)
|
||||
[View Version History](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/ReleaseNotes.md)
|
||||
|
||||
## Basics
|
||||
TimberWinR uses a configuration file to control how the logs are collected, filtered and shipped off.
|
||||
@@ -30,27 +38,27 @@ Latest Build:
|
||||
|
||||
## Inputs
|
||||
The current supported Input format sources are:
|
||||
1. [Logs](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Logs.md) (Files, a.k.a Tailing a file)
|
||||
2. [Tcp](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/TcpInput.md) (listens on TCP port for JSON messages)
|
||||
3. [IISW3C](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/IISW3CInput.md)(Internet Information Services W3C Format)
|
||||
4. [WindowsEvents](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/WindowsEvents.md) (Windows Event Viewer)
|
||||
5. [Stdin](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StdinInput.md) (Standard Input for Debugging)
|
||||
6. [W3C](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/W3CInput.md)(Internet Information Services W3C Advanced/Custom Format)
|
||||
7. [Udp](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/UdpInput.md) (listens for UDP on port for JSON messages)
|
||||
8. [TailFiles](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/TailFiles.md) (Tails log files efficiently)
|
||||
8. [Generator](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Generator.md) (Generate logs for testing *New*)
|
||||
1. [Logs](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/Logs.md) (Files, a.k.a Tailing a file)
|
||||
2. [Tcp](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/TcpInput.md) (listens on TCP port for JSON messages)
|
||||
3. [IISW3C](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/IISW3CInput.md)(Internet Information Services W3C Format)
|
||||
4. [WindowsEvents](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/WindowsEvents.md) (Windows Event Viewer)
|
||||
5. [Stdin](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/StdinInput.md) (Standard Input for Debugging)
|
||||
6. [W3C](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/W3CInput.md)(Internet Information Services W3C Advanced/Custom Format)
|
||||
7. [Udp](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/UdpInput.md) (listens for UDP on port for JSON messages)
|
||||
8. [TailFiles](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/TailFiles.md) (Tails log files efficiently)
|
||||
8. [Generator](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/Generator.md) (Generate logs for testing *New*)
|
||||
|
||||
## Codecs
|
||||
The current list of supported codecs are:
|
||||
1. [Multiline](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)
|
||||
1. [Multiline](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)
|
||||
|
||||
## Filters
|
||||
The current list of supported filters are:
|
||||
1. [Grok](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/GrokFilter.md)
|
||||
2. [Mutate](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/MutateFilter.md)
|
||||
3. [Date](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/DateFilter.md)
|
||||
4. [Json](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/JsonFilter.md)
|
||||
5. [GeoIP](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/GeoIPFilter.md)
|
||||
1. [Grok](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/GrokFilter.md)
|
||||
2. [Mutate](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/MutateFilter.md)
|
||||
3. [Date](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/DateFilter.md)
|
||||
4. [Json](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/JsonFilter.md)
|
||||
5. [GeoIP](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/GeoIPFilter.md)
|
||||
|
||||
Note that there are now two syntaxes for filters, array and single, if you want more than one filter of the same
|
||||
type then you must use the array tag instead of the singular tag. i.e:
|
||||
@@ -104,11 +112,11 @@ Since TimberWinR only ships to Redis and Elasticsearch, the format generated by
|
||||
represented as a JSON Property or Array.
|
||||
|
||||
## Outputs
|
||||
1. [Redis](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/RedisOutput.md)
|
||||
2. [Elasticsearch](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/ElasticsearchOutput.md)
|
||||
3. [Stdout](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StdoutOutput.md)
|
||||
4. [File](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/FileOutput.md)
|
||||
5. [StatsD](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StatsD.md)
|
||||
1. [Redis](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/RedisOutput.md)
|
||||
2. [Elasticsearch](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/ElasticsearchOutput.md)
|
||||
3. [Stdout](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/StdoutOutput.md)
|
||||
4. [File](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/FileOutput.md)
|
||||
5. [StatsD](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/StatsD.md)
|
||||
|
||||
## Sample Configuration
|
||||
TimberWinR reads a JSON configuration file, an example file is shown here:
|
||||
|
||||
@@ -1,4 +1,6 @@
|
||||
namespace TimberWinR.UnitTests.Parser
|
||||
using TimberWinR.Outputs;
|
||||
|
||||
namespace TimberWinR.UnitTests.Parser
|
||||
{
|
||||
using System;
|
||||
|
||||
@@ -51,5 +53,51 @@
|
||||
|
||||
Assert.AreEqual("someindex-" + DateTime.UtcNow.ToString("yyyy.MM.dd"), result);
|
||||
}
|
||||
|
||||
[Test]
|
||||
public void Given_no_ssl_then_validate_does_not_throw()
|
||||
{
|
||||
parser.Ssl = false;
|
||||
Assert.That(() => parser.Validate(), Throws.Nothing);
|
||||
}
|
||||
|
||||
[Test]
|
||||
public void Given_ssl_and_no_username_then_validate_throws()
|
||||
{
|
||||
parser.Ssl = true;
|
||||
parser.Password = "pass";
|
||||
|
||||
Assert.That(() => parser.Validate(), Throws.Exception.InstanceOf<ElasticsearchOutputParameters.ElasticsearchBasicAuthException>());
|
||||
}
|
||||
|
||||
[Test]
|
||||
public void Given_ssl_and_no_password_then_validate_throws()
|
||||
{
|
||||
parser.Ssl = true;
|
||||
parser.Username = "user";
|
||||
|
||||
Assert.That(() => parser.Validate(), Throws.Exception.InstanceOf<ElasticsearchOutputParameters.ElasticsearchBasicAuthException>());
|
||||
}
|
||||
|
||||
[Test]
|
||||
public void Given_ssl_and_username_and_password_then_validate_does_not_throw()
|
||||
{
|
||||
parser.Ssl = true;
|
||||
parser.Username = "user";
|
||||
parser.Password = "pass";
|
||||
|
||||
Assert.That(() => parser.Validate(), Throws.Nothing);
|
||||
}
|
||||
|
||||
[Test]
|
||||
[TestCase("host", 1234, false, null, null, "http://host:1234/")]
|
||||
[TestCase("host", 1234, true, "user", "pass", "https://user:pass@host:1234/")]
|
||||
[TestCase("host", 1234, true, "user:", "pass@", "https://user%3A:pass%40@host:1234/")]
|
||||
public void ComposeUri_Matches_Expected(string host, int port, bool ssl, string username, string password, string expectedUri)
|
||||
{
|
||||
var uri = ElasticsearchOutput.ComposeUri(host, port, ssl, username, password);
|
||||
|
||||
Assert.That(uri.ToString(), Is.EqualTo(expectedUri));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -29,6 +29,9 @@ namespace TimberWinR.Outputs
|
||||
{
|
||||
private TimberWinR.Manager _manager;
|
||||
private readonly int _port;
|
||||
private readonly bool _ssl;
|
||||
private readonly string _username;
|
||||
private readonly string _password;
|
||||
private readonly int _interval;
|
||||
private readonly int _flushSize;
|
||||
private readonly int _idleFlushTimeSeconds;
|
||||
@@ -57,8 +60,8 @@ namespace TimberWinR.Outputs
|
||||
var nodes = new List<Uri>();
|
||||
foreach (var host in _hosts)
|
||||
{
|
||||
var url = string.Format("http://{0}:{1}", host, _port);
|
||||
nodes.Add(new Uri(url));
|
||||
var uri = ComposeUri(host, _port, _ssl, _username, _password);
|
||||
nodes.Add(uri);
|
||||
}
|
||||
var pool = new StaticConnectionPool(nodes.ToArray());
|
||||
var settings = new ConnectionSettings(pool)
|
||||
@@ -73,6 +76,13 @@ namespace TimberWinR.Outputs
|
||||
return client;
|
||||
}
|
||||
|
||||
public static Uri ComposeUri(string host, int port, bool ssl, string username, string password)
|
||||
{
|
||||
return ssl
|
||||
? new Uri(string.Format("https://{0}:{1}@{2}:{3}", Uri.EscapeDataString(username), Uri.EscapeDataString(password), host, port))
|
||||
: new Uri(string.Format("http://{0}:{1}", host, port));
|
||||
}
|
||||
|
||||
public ElasticsearchOutput(TimberWinR.Manager manager, Parser.ElasticsearchOutputParameters parameters, CancellationToken cancelToken)
|
||||
: base(cancelToken, "Elasticsearch")
|
||||
{
|
||||
@@ -86,6 +96,9 @@ namespace TimberWinR.Outputs
|
||||
_timeout = parameters.Timeout;
|
||||
_manager = manager;
|
||||
_port = parameters.Port;
|
||||
_ssl = parameters.Ssl;
|
||||
_username = parameters.Username;
|
||||
_password = parameters.Password;
|
||||
_interval = parameters.Interval;
|
||||
_hosts = parameters.Host;
|
||||
_jsonQueue = new List<JObject>();
|
||||
@@ -111,6 +124,9 @@ namespace TimberWinR.Outputs
|
||||
new JProperty("messages", _sentMessages),
|
||||
new JProperty("queuedMessageCount", _jsonQueue.Count),
|
||||
new JProperty("port", _port),
|
||||
new JProperty("ssl", _ssl),
|
||||
new JProperty("username", _username),
|
||||
new JProperty("password", _password),
|
||||
new JProperty("flushSize", _flushSize),
|
||||
new JProperty("idleFlushTime", _idleFlushTimeSeconds),
|
||||
new JProperty("interval", _interval),
|
||||
|
||||
@@ -625,8 +625,16 @@ namespace TimberWinR.Parser
|
||||
}
|
||||
|
||||
|
||||
public class ElasticsearchOutputParameters
|
||||
public class ElasticsearchOutputParameters : IValidateSchema
|
||||
{
|
||||
public class ElasticsearchBasicAuthException : Exception
|
||||
{
|
||||
public ElasticsearchBasicAuthException()
|
||||
: base("Elasticsearch 'username' and 'password' properties must be set when SSL is enabled.")
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
const string IndexDatePattern = "(%\\{(?<format>[^\\}]+)\\})";
|
||||
|
||||
[JsonProperty(PropertyName = "host")]
|
||||
@@ -635,6 +643,12 @@ namespace TimberWinR.Parser
|
||||
public string Index { get; set; }
|
||||
[JsonProperty(PropertyName = "port")]
|
||||
public int Port { get; set; }
|
||||
[JsonProperty(PropertyName = "ssl")]
|
||||
public bool Ssl { get; set; }
|
||||
[JsonProperty(PropertyName = "username")]
|
||||
public string Username { get; set; }
|
||||
[JsonProperty(PropertyName = "password")]
|
||||
public string Password { get; set; }
|
||||
[JsonProperty(PropertyName = "timeout")]
|
||||
public int Timeout { get; set; }
|
||||
[JsonProperty(PropertyName = "threads")]
|
||||
@@ -662,6 +676,9 @@ namespace TimberWinR.Parser
|
||||
IdleFlushTimeInSeconds = 10;
|
||||
Protocol = "http";
|
||||
Port = 9200;
|
||||
Ssl = false;
|
||||
Username = string.Empty;
|
||||
Password = string.Empty;
|
||||
Index = "";
|
||||
Host = new string[] { "localhost" };
|
||||
Timeout = 10000;
|
||||
@@ -711,6 +728,11 @@ namespace TimberWinR.Parser
|
||||
return typeName;
|
||||
}
|
||||
|
||||
public void Validate()
|
||||
{
|
||||
if (Ssl && (string.IsNullOrWhiteSpace(Username) || string.IsNullOrWhiteSpace(Password)))
|
||||
throw new ElasticsearchBasicAuthException();
|
||||
}
|
||||
}
|
||||
|
||||
public class RedisOutputParameters
|
||||
|
||||
@@ -14,6 +14,9 @@ The following parameters are allowed when configuring the Elasticsearch output.
|
||||
| *interval* | integer | Interval in milliseconds to sleep during batch sends | Interval | 5000 |
|
||||
| *max_queue_size* | integer | Maximum Elasticsearch queue depth | | 50000 |
|
||||
| *port* | integer | Elasticsearch port number | This port must be open | 9200 |
|
||||
| *ssl* | bool | If true, use an HTTPS connection to Elasticsearch. See [this page] (https://www.elastic.co/guide/en/found/current/elk-and-found.html#_using_logstash) for a configuration example. | *username* and *password* are also required for HTTPS connections. | false |
|
||||
| *username* | string | Username for Elasticsearch credentials. | Required for HTTPS connection. | |
|
||||
| *password* | string | Password for Elasticsearch credentials. | Required for HTTPS connection. | |
|
||||
| *queue_overflow_discard_oldest* | bool | If true, discard oldest messages when max_queue_size reached otherwise discard newest | | true |
|
||||
| *threads* | [string] | Number of Threads | Number of worker threads processing messages | 1 |
|
||||
| *enable_ping* | bool | If true, pings the server to test for keep alive | | false |
|
||||
|
||||
@@ -65,3 +65,5 @@ After a successful parse of an event, the following fields are added:
|
||||
| Message | STRING | The full event message |
|
||||
| Data | STRING | The binary data associated with the event |
|
||||
|
||||
|
||||
|
||||
|
||||
BIN
timberwinr.jpg
Normal file
BIN
timberwinr.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 6.0 KiB |
Reference in New Issue
Block a user