Rundeck streaming log writer and Logstash input

framework.properties

# ...

framework.plugin.StreamingLogWriter.LogstashPlugin.port=9700
framework.plugin.StreamingLogWriter.LogstashPlugin.host=localhost

LogstashPlugin.groovy

import com.dtolabs.rundeck.plugins.logging.StreamingLogWriterPlugin;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.dtolabs.rundeck.core.logging.LogEvent;
import com.dtolabs.rundeck.core.logging.LogLevel;

/**
 * Opens a TCP connection, and writes JSON event messages to the socket
 */
rundeckPlugin(StreamingLogWriterPlugin){
    configuration{
        host defaultValue:"localhost", required:true, description: "Hostname to connect to"
        port required:true, description: "Port to connect to", type: 'Integer'
    }
    /**
     * open the socket, prepare some metadata
     */
    open { Map execution, Map config ->
        def socket = new Socket(config.host, config.port.toInteger());
        def socketStream = socket.getOutputStream();
        def e2 = [:]
        execution.each{ e2["execution.${it.key}"]=it.value }
        def json=new ObjectMapper()
        
        [socket:socket, count:0, executionid:execution.execid, write:{
            socketStream<< json.writeValueAsString(e2 + it) + "\n"            
        }]
    }

    /**
     * write the log event and metadata as json to the socket
     */
    addEvent { Map context, LogEvent event->
        
        context.count++
        
        def emeta=[:]
        
        event.metadata?.each{ emeta["event.${it.key}"]=it.value }

        def data= emeta + [
            line:context.count,
            datetime:event.datetime.time,
            loglevel:event.loglevel.toString(),
            message:event.message,
            eventType:event.eventType,
        ]

        context.write data
    }
    /**
     * close the socket
     */
    close { 
        context.write ending:true, totallines:context.count, message: 'Execution '+context.executionid+' finished.'
        context.socket.close();
    }
}

run-logstash.sh

#!/bin/bash

java -jar ../logstash-1.1.13-flatjar.jar agent -f rundeck-logstash.conf -- web --backend elasticsearch://localhost/

rundeck-config.properties

#loglevel.default is the default log level for jobs: ERROR,WARN,INFO,VERBOSE,DEBUG
loglevel.default=INFO
rdeck.base=/var/lib/rundeck

#rss.enabled if set to true enables RSS feeds that are public (non-authenticated)
rss.enabled=true
grails.serverURL=http://localhost:4440
dataSource.dbCreate = update
dataSource.url = jdbc:h2:file:/var/lib/rundeck/data/grailsdb;MVCC=true

rundeck.execution.logs.streamingWriterPlugins=LogstashPlugin

rundeck-logstash.conf

input {
  
  tcp {
    debug => true 
    format => "json"
    host => "localhost"
    message_format => "%{message}"
    mode => server
    port => 9700
    #ssl_cacert => ... # a valid filesystem path (optional)
    #ssl_cert => ... # a valid filesystem path (optional)
    #ssl_enable => ... # boolean (optional), default: false
    #ssl_key => ... # a valid filesystem path (optional)
    #ssl_key_passphrase => ... # password (optional), default: nil
    #ssl_verify => ... # boolean (optional), default: false
    tags => ["rundeck"]
    type => "rundeck"
  }

}

output { 
  stdout { }

  elasticsearch { embedded => true }
}