heka syslog with fallback

gistfile1.toml

[rsyslog-with-fallback-decoder]
type             = "MultiDecoder"
subs             = ['WellFormedRyslogForwardFormatDecoder', 'BestGuessRyslogForwardFormatDecoder', 'SyslogParseFailureDecoder']
cascade_strategy = "first-wins"

[WellFormedRyslogForwardFormatDecoder]
type             = "SandboxDecoder"
module_directory = "/usr/share/heka/lua_modules"
filename         = "/usr/share/heka/lua_decoders/rsyslog.lua"
script_type      = "lua"

[WellFormedRyslogForwardFormatDecoder.config]
template = '<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%'

# We use date-rfc3339 so don't set this off UTC, or face double-offsets.
tz       = "UTC"

[BestGuessRyslogForwardFormatDecoder]
type             = "SandboxDecoder"
module_directory = "/usr/share/heka/lua_modules"
filename         = "/usr/share/heka/lua_decoders/rsyslog.lua"
script_type      = "lua"

[BestGuessRyslogForwardFormatDecoder.config]
# Example:
# <166>2014-06-26T23:13:23-07:00 chi-prod-dirac-54.nr-ops.net     at org.apache.http.impl.io.AbstractSessionInputBuffer.readLine(AbstractSessionInputBuffer.java:281)\u000a
template = '<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %msg%'
tz       = "UTC"

[SyslogParseFailureDecoder]
type = "ScribbleDecoder"
[SyslogParseFailureDecoder.message_fields]
Type = "SyslogParseFailure"