Log.io output plugin for Logstash -- logstash / lib / logstash / outputs / logio.rb

logio.rb

require "logstash/outputs/base"
require "logstash/namespace"
require "socket"

# Log.io Output
#
# Sends events to a Log.io server over TCP.
#
# Plugin is fault tolerant.  If the plugin is unable to connect to the server,
# or writes to a broken socket, it will attempt to reconnect indefinitely.
#
# This logstash plugin was converted to a gist by Luke Chavers <github.com/vmadman>
# Source was taken from: https://github.com/msmathers/logstash/blob/develop/log.io/lib/logstash/outputs/logio.rb
# See also: http://narrativescience.com/blog/announcing-the-new-log-io/
#
class LogStash::Outputs::LogIO < LogStash::Outputs::Base

  config_name "logio"
  plugin_status 0

  # log.io server host
  config :host, :validate => :string, :required => true

  # log.io server TCP port
  config :port, :validate => :number, :default => 28777

  # log.io TCP message format
  config :format, :default => "+log|%{@source}|%{@source_host}|%{@level}|%{@timestamp}: %{@message}\r\n"

  public
  def register
    connect
  end

  public
  def receive(event)
    return unless output?(event)
    msg = event.sprintf(@format)
    send_log(msg)
  end

  private
  def connect
    begin
      @sock = TCPSocket.open(@host, @port)
    rescue
      sleep(2)
      connect
    end
  end

  private
  def send_log(msg)
    begin
      @sock.puts msg
    rescue
      sleep(2)
      connect
    end
  end
end

A note to anyone who stumbles across this. The original log.io plugin provided by the log.io guys is not Logstash 1.2.x compatible. I began working on making it 1.2.2 compatible but when considering the codec modifications I realized that 1.2.x may eliminate the need for this plugin all together since this plugin basically only amounts to formatting messages. Currently I'm just trying to get it working with the TCP output plugin and, likely, the 'plain' codec.

Ended up writing a log.io codec, it really boiled down to the \r\n that log.io likes for the event terminator.

The codec plugin I made is pretty robust, and aside from my rather shotty ruby skills its pretty high quality.

More info here: elastic/logstash#796