Compare commits
6 Commits
release/0.
...
master
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
5165224c65 | ||
|
|
fd9306e24e | ||
|
|
050ae7cf84 | ||
|
|
a99b04e1b1 | ||
|
|
dddbf6ae0d | ||
|
|
147e243478 |
50
README.md
50
README.md
@@ -2,6 +2,14 @@ TimberWinR
|
|||||||
==========
|
==========
|
||||||
A Native Windows to Redis/Elasticsearch Logstash Agent which runs as a service.
|
A Native Windows to Redis/Elasticsearch Logstash Agent which runs as a service.
|
||||||
|
|
||||||
|
## Development and Roadmap
|
||||||
|
|
||||||
|
TimberWinR's development has been and in the short term will continue to be on a hiatus. The project's ownership has been recently transferred, and thus the project will be slow to pick up steam again. Currently a roadmap is being established, and a vision for the project is currently being formulated.
|
||||||
|
|
||||||
|
#### Getting Involved
|
||||||
|
|
||||||
|
If you wish to be involved with TimberWinR in an on-going basis file an issue.
|
||||||
|
|
||||||
## Why have TimberWinR?
|
## Why have TimberWinR?
|
||||||
TimberWinR is a native .NET implementation utilizing Microsoft's [LogParser](http://technet.microsoft.com/en-us/scriptcenter/dd919274.aspx). This means
|
TimberWinR is a native .NET implementation utilizing Microsoft's [LogParser](http://technet.microsoft.com/en-us/scriptcenter/dd919274.aspx). This means
|
||||||
no JVM/JRuby is required, and LogParser does all the heavy lifting. TimberWinR collects
|
no JVM/JRuby is required, and LogParser does all the heavy lifting. TimberWinR collects
|
||||||
@@ -9,7 +17,7 @@ the data from LogParser and ships it to Logstash via Redis (or can ship direcly
|
|||||||
|
|
||||||
## Release Notes
|
## Release Notes
|
||||||
|
|
||||||
[View Version History](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/ReleaseNotes.md)
|
[View Version History](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/ReleaseNotes.md)
|
||||||
|
|
||||||
## Basics
|
## Basics
|
||||||
TimberWinR uses a configuration file to control how the logs are collected, filtered and shipped off.
|
TimberWinR uses a configuration file to control how the logs are collected, filtered and shipped off.
|
||||||
@@ -30,27 +38,27 @@ Latest Build:
|
|||||||
|
|
||||||
## Inputs
|
## Inputs
|
||||||
The current supported Input format sources are:
|
The current supported Input format sources are:
|
||||||
1. [Logs](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Logs.md) (Files, a.k.a Tailing a file)
|
1. [Logs](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/Logs.md) (Files, a.k.a Tailing a file)
|
||||||
2. [Tcp](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/TcpInput.md) (listens on TCP port for JSON messages)
|
2. [Tcp](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/TcpInput.md) (listens on TCP port for JSON messages)
|
||||||
3. [IISW3C](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/IISW3CInput.md)(Internet Information Services W3C Format)
|
3. [IISW3C](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/IISW3CInput.md)(Internet Information Services W3C Format)
|
||||||
4. [WindowsEvents](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/WindowsEvents.md) (Windows Event Viewer)
|
4. [WindowsEvents](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/WindowsEvents.md) (Windows Event Viewer)
|
||||||
5. [Stdin](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StdinInput.md) (Standard Input for Debugging)
|
5. [Stdin](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/StdinInput.md) (Standard Input for Debugging)
|
||||||
6. [W3C](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/W3CInput.md)(Internet Information Services W3C Advanced/Custom Format)
|
6. [W3C](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/W3CInput.md)(Internet Information Services W3C Advanced/Custom Format)
|
||||||
7. [Udp](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/UdpInput.md) (listens for UDP on port for JSON messages)
|
7. [Udp](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/UdpInput.md) (listens for UDP on port for JSON messages)
|
||||||
8. [TailFiles](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/TailFiles.md) (Tails log files efficiently)
|
8. [TailFiles](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/TailFiles.md) (Tails log files efficiently)
|
||||||
8. [Generator](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Generator.md) (Generate logs for testing *New*)
|
8. [Generator](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/Generator.md) (Generate logs for testing *New*)
|
||||||
|
|
||||||
## Codecs
|
## Codecs
|
||||||
The current list of supported codecs are:
|
The current list of supported codecs are:
|
||||||
1. [Multiline](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)
|
1. [Multiline](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/Codec.md)
|
||||||
|
|
||||||
## Filters
|
## Filters
|
||||||
The current list of supported filters are:
|
The current list of supported filters are:
|
||||||
1. [Grok](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/GrokFilter.md)
|
1. [Grok](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/GrokFilter.md)
|
||||||
2. [Mutate](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/MutateFilter.md)
|
2. [Mutate](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/MutateFilter.md)
|
||||||
3. [Date](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/DateFilter.md)
|
3. [Date](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/DateFilter.md)
|
||||||
4. [Json](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/JsonFilter.md)
|
4. [Json](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/JsonFilter.md)
|
||||||
5. [GeoIP](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/GeoIPFilter.md)
|
5. [GeoIP](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/GeoIPFilter.md)
|
||||||
|
|
||||||
Note that there are now two syntaxes for filters, array and single, if you want more than one filter of the same
|
Note that there are now two syntaxes for filters, array and single, if you want more than one filter of the same
|
||||||
type then you must use the array tag instead of the singular tag. i.e:
|
type then you must use the array tag instead of the singular tag. i.e:
|
||||||
@@ -104,11 +112,11 @@ Since TimberWinR only ships to Redis and Elasticsearch, the format generated by
|
|||||||
represented as a JSON Property or Array.
|
represented as a JSON Property or Array.
|
||||||
|
|
||||||
## Outputs
|
## Outputs
|
||||||
1. [Redis](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/RedisOutput.md)
|
1. [Redis](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/RedisOutput.md)
|
||||||
2. [Elasticsearch](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/ElasticsearchOutput.md)
|
2. [Elasticsearch](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/ElasticsearchOutput.md)
|
||||||
3. [Stdout](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StdoutOutput.md)
|
3. [Stdout](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/StdoutOutput.md)
|
||||||
4. [File](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/FileOutput.md)
|
4. [File](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/FileOutput.md)
|
||||||
5. [StatsD](https://github.com/Cimpress-MCP/TimberWinR/blob/master/TimberWinR/mdocs/StatsD.md)
|
5. [StatsD](https://github.com/tparnell8/TimberWinR/blob/master/TimberWinR/mdocs/StatsD.md)
|
||||||
|
|
||||||
## Sample Configuration
|
## Sample Configuration
|
||||||
TimberWinR reads a JSON configuration file, an example file is shown here:
|
TimberWinR reads a JSON configuration file, an example file is shown here:
|
||||||
|
|||||||
@@ -1,4 +1,6 @@
|
|||||||
namespace TimberWinR.UnitTests.Parser
|
using TimberWinR.Outputs;
|
||||||
|
|
||||||
|
namespace TimberWinR.UnitTests.Parser
|
||||||
{
|
{
|
||||||
using System;
|
using System;
|
||||||
|
|
||||||
@@ -51,5 +53,51 @@
|
|||||||
|
|
||||||
Assert.AreEqual("someindex-" + DateTime.UtcNow.ToString("yyyy.MM.dd"), result);
|
Assert.AreEqual("someindex-" + DateTime.UtcNow.ToString("yyyy.MM.dd"), result);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
[Test]
|
||||||
|
public void Given_no_ssl_then_validate_does_not_throw()
|
||||||
|
{
|
||||||
|
parser.Ssl = false;
|
||||||
|
Assert.That(() => parser.Validate(), Throws.Nothing);
|
||||||
|
}
|
||||||
|
|
||||||
|
[Test]
|
||||||
|
public void Given_ssl_and_no_username_then_validate_throws()
|
||||||
|
{
|
||||||
|
parser.Ssl = true;
|
||||||
|
parser.Password = "pass";
|
||||||
|
|
||||||
|
Assert.That(() => parser.Validate(), Throws.Exception.InstanceOf<ElasticsearchOutputParameters.ElasticsearchBasicAuthException>());
|
||||||
|
}
|
||||||
|
|
||||||
|
[Test]
|
||||||
|
public void Given_ssl_and_no_password_then_validate_throws()
|
||||||
|
{
|
||||||
|
parser.Ssl = true;
|
||||||
|
parser.Username = "user";
|
||||||
|
|
||||||
|
Assert.That(() => parser.Validate(), Throws.Exception.InstanceOf<ElasticsearchOutputParameters.ElasticsearchBasicAuthException>());
|
||||||
|
}
|
||||||
|
|
||||||
|
[Test]
|
||||||
|
public void Given_ssl_and_username_and_password_then_validate_does_not_throw()
|
||||||
|
{
|
||||||
|
parser.Ssl = true;
|
||||||
|
parser.Username = "user";
|
||||||
|
parser.Password = "pass";
|
||||||
|
|
||||||
|
Assert.That(() => parser.Validate(), Throws.Nothing);
|
||||||
|
}
|
||||||
|
|
||||||
|
[Test]
|
||||||
|
[TestCase("host", 1234, false, null, null, "http://host:1234/")]
|
||||||
|
[TestCase("host", 1234, true, "user", "pass", "https://user:pass@host:1234/")]
|
||||||
|
[TestCase("host", 1234, true, "user:", "pass@", "https://user%3A:pass%40@host:1234/")]
|
||||||
|
public void ComposeUri_Matches_Expected(string host, int port, bool ssl, string username, string password, string expectedUri)
|
||||||
|
{
|
||||||
|
var uri = ElasticsearchOutput.ComposeUri(host, port, ssl, username, password);
|
||||||
|
|
||||||
|
Assert.That(uri.ToString(), Is.EqualTo(expectedUri));
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -29,6 +29,9 @@ namespace TimberWinR.Outputs
|
|||||||
{
|
{
|
||||||
private TimberWinR.Manager _manager;
|
private TimberWinR.Manager _manager;
|
||||||
private readonly int _port;
|
private readonly int _port;
|
||||||
|
private readonly bool _ssl;
|
||||||
|
private readonly string _username;
|
||||||
|
private readonly string _password;
|
||||||
private readonly int _interval;
|
private readonly int _interval;
|
||||||
private readonly int _flushSize;
|
private readonly int _flushSize;
|
||||||
private readonly int _idleFlushTimeSeconds;
|
private readonly int _idleFlushTimeSeconds;
|
||||||
@@ -57,8 +60,8 @@ namespace TimberWinR.Outputs
|
|||||||
var nodes = new List<Uri>();
|
var nodes = new List<Uri>();
|
||||||
foreach (var host in _hosts)
|
foreach (var host in _hosts)
|
||||||
{
|
{
|
||||||
var url = string.Format("http://{0}:{1}", host, _port);
|
var uri = ComposeUri(host, _port, _ssl, _username, _password);
|
||||||
nodes.Add(new Uri(url));
|
nodes.Add(uri);
|
||||||
}
|
}
|
||||||
var pool = new StaticConnectionPool(nodes.ToArray());
|
var pool = new StaticConnectionPool(nodes.ToArray());
|
||||||
var settings = new ConnectionSettings(pool)
|
var settings = new ConnectionSettings(pool)
|
||||||
@@ -73,6 +76,13 @@ namespace TimberWinR.Outputs
|
|||||||
return client;
|
return client;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public static Uri ComposeUri(string host, int port, bool ssl, string username, string password)
|
||||||
|
{
|
||||||
|
return ssl
|
||||||
|
? new Uri(string.Format("https://{0}:{1}@{2}:{3}", Uri.EscapeDataString(username), Uri.EscapeDataString(password), host, port))
|
||||||
|
: new Uri(string.Format("http://{0}:{1}", host, port));
|
||||||
|
}
|
||||||
|
|
||||||
public ElasticsearchOutput(TimberWinR.Manager manager, Parser.ElasticsearchOutputParameters parameters, CancellationToken cancelToken)
|
public ElasticsearchOutput(TimberWinR.Manager manager, Parser.ElasticsearchOutputParameters parameters, CancellationToken cancelToken)
|
||||||
: base(cancelToken, "Elasticsearch")
|
: base(cancelToken, "Elasticsearch")
|
||||||
{
|
{
|
||||||
@@ -86,6 +96,9 @@ namespace TimberWinR.Outputs
|
|||||||
_timeout = parameters.Timeout;
|
_timeout = parameters.Timeout;
|
||||||
_manager = manager;
|
_manager = manager;
|
||||||
_port = parameters.Port;
|
_port = parameters.Port;
|
||||||
|
_ssl = parameters.Ssl;
|
||||||
|
_username = parameters.Username;
|
||||||
|
_password = parameters.Password;
|
||||||
_interval = parameters.Interval;
|
_interval = parameters.Interval;
|
||||||
_hosts = parameters.Host;
|
_hosts = parameters.Host;
|
||||||
_jsonQueue = new List<JObject>();
|
_jsonQueue = new List<JObject>();
|
||||||
@@ -111,6 +124,9 @@ namespace TimberWinR.Outputs
|
|||||||
new JProperty("messages", _sentMessages),
|
new JProperty("messages", _sentMessages),
|
||||||
new JProperty("queuedMessageCount", _jsonQueue.Count),
|
new JProperty("queuedMessageCount", _jsonQueue.Count),
|
||||||
new JProperty("port", _port),
|
new JProperty("port", _port),
|
||||||
|
new JProperty("ssl", _ssl),
|
||||||
|
new JProperty("username", _username),
|
||||||
|
new JProperty("password", _password),
|
||||||
new JProperty("flushSize", _flushSize),
|
new JProperty("flushSize", _flushSize),
|
||||||
new JProperty("idleFlushTime", _idleFlushTimeSeconds),
|
new JProperty("idleFlushTime", _idleFlushTimeSeconds),
|
||||||
new JProperty("interval", _interval),
|
new JProperty("interval", _interval),
|
||||||
|
|||||||
@@ -625,8 +625,16 @@ namespace TimberWinR.Parser
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
public class ElasticsearchOutputParameters
|
public class ElasticsearchOutputParameters : IValidateSchema
|
||||||
{
|
{
|
||||||
|
public class ElasticsearchBasicAuthException : Exception
|
||||||
|
{
|
||||||
|
public ElasticsearchBasicAuthException()
|
||||||
|
: base("Elasticsearch 'username' and 'password' properties must be set when SSL is enabled.")
|
||||||
|
{
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
const string IndexDatePattern = "(%\\{(?<format>[^\\}]+)\\})";
|
const string IndexDatePattern = "(%\\{(?<format>[^\\}]+)\\})";
|
||||||
|
|
||||||
[JsonProperty(PropertyName = "host")]
|
[JsonProperty(PropertyName = "host")]
|
||||||
@@ -635,6 +643,12 @@ namespace TimberWinR.Parser
|
|||||||
public string Index { get; set; }
|
public string Index { get; set; }
|
||||||
[JsonProperty(PropertyName = "port")]
|
[JsonProperty(PropertyName = "port")]
|
||||||
public int Port { get; set; }
|
public int Port { get; set; }
|
||||||
|
[JsonProperty(PropertyName = "ssl")]
|
||||||
|
public bool Ssl { get; set; }
|
||||||
|
[JsonProperty(PropertyName = "username")]
|
||||||
|
public string Username { get; set; }
|
||||||
|
[JsonProperty(PropertyName = "password")]
|
||||||
|
public string Password { get; set; }
|
||||||
[JsonProperty(PropertyName = "timeout")]
|
[JsonProperty(PropertyName = "timeout")]
|
||||||
public int Timeout { get; set; }
|
public int Timeout { get; set; }
|
||||||
[JsonProperty(PropertyName = "threads")]
|
[JsonProperty(PropertyName = "threads")]
|
||||||
@@ -662,6 +676,9 @@ namespace TimberWinR.Parser
|
|||||||
IdleFlushTimeInSeconds = 10;
|
IdleFlushTimeInSeconds = 10;
|
||||||
Protocol = "http";
|
Protocol = "http";
|
||||||
Port = 9200;
|
Port = 9200;
|
||||||
|
Ssl = false;
|
||||||
|
Username = string.Empty;
|
||||||
|
Password = string.Empty;
|
||||||
Index = "";
|
Index = "";
|
||||||
Host = new string[] { "localhost" };
|
Host = new string[] { "localhost" };
|
||||||
Timeout = 10000;
|
Timeout = 10000;
|
||||||
@@ -711,6 +728,11 @@ namespace TimberWinR.Parser
|
|||||||
return typeName;
|
return typeName;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public void Validate()
|
||||||
|
{
|
||||||
|
if (Ssl && (string.IsNullOrWhiteSpace(Username) || string.IsNullOrWhiteSpace(Password)))
|
||||||
|
throw new ElasticsearchBasicAuthException();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
public class RedisOutputParameters
|
public class RedisOutputParameters
|
||||||
|
|||||||
@@ -14,6 +14,9 @@ The following parameters are allowed when configuring the Elasticsearch output.
|
|||||||
| *interval* | integer | Interval in milliseconds to sleep during batch sends | Interval | 5000 |
|
| *interval* | integer | Interval in milliseconds to sleep during batch sends | Interval | 5000 |
|
||||||
| *max_queue_size* | integer | Maximum Elasticsearch queue depth | | 50000 |
|
| *max_queue_size* | integer | Maximum Elasticsearch queue depth | | 50000 |
|
||||||
| *port* | integer | Elasticsearch port number | This port must be open | 9200 |
|
| *port* | integer | Elasticsearch port number | This port must be open | 9200 |
|
||||||
|
| *ssl* | bool | If true, use an HTTPS connection to Elasticsearch. See [this page] (https://www.elastic.co/guide/en/found/current/elk-and-found.html#_using_logstash) for a configuration example. | *username* and *password* are also required for HTTPS connections. | false |
|
||||||
|
| *username* | string | Username for Elasticsearch credentials. | Required for HTTPS connection. | |
|
||||||
|
| *password* | string | Password for Elasticsearch credentials. | Required for HTTPS connection. | |
|
||||||
| *queue_overflow_discard_oldest* | bool | If true, discard oldest messages when max_queue_size reached otherwise discard newest | | true |
|
| *queue_overflow_discard_oldest* | bool | If true, discard oldest messages when max_queue_size reached otherwise discard newest | | true |
|
||||||
| *threads* | [string] | Number of Threads | Number of worker threads processing messages | 1 |
|
| *threads* | [string] | Number of Threads | Number of worker threads processing messages | 1 |
|
||||||
| *enable_ping* | bool | If true, pings the server to test for keep alive | | false |
|
| *enable_ping* | bool | If true, pings the server to test for keep alive | | false |
|
||||||
|
|||||||
@@ -65,3 +65,5 @@ After a successful parse of an event, the following fields are added:
|
|||||||
| Message | STRING | The full event message |
|
| Message | STRING | The full event message |
|
||||||
| Data | STRING | The binary data associated with the event |
|
| Data | STRING | The binary data associated with the event |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
BIN
timberwinr.jpg
Normal file
BIN
timberwinr.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 6.0 KiB |
Reference in New Issue
Block a user