org.thales.punch.libraries.punchlang.operator

Class SyslogHeaderOperator

java.lang.Object

org.thales.punch.libraries.punchlang.operator.SyslogHeaderOperator

public class SyslogHeaderOperator
extends Object

The SyslogHeaderOperator is designed to perform a very efficient extraction of the date, host, optional priority and severity from a syslog header.

The way it works is as follows. You provide a raw log expected to start with a syslog header. The SyslogHeaderOperator returns to you the parsed header in one tuple, the rest of your log in another. Here is an example :

  String rawLog = "Sep 21 21:24:03 fakehost the-rest-of-the-data";
  Tuple header;
  Tuple greedyData;
  syslogHeader().on(rawLog).into(header, greedyData);

  // Header contains
  // I.e. if you write print(header) you get
 {
 "alarm": {
 "sev": 0,
 "facility": 0
 },
 "rep": {
 "host": {
 "name": "fakehost"
 },
 "ts": "Sep 21 21:24:3"
 }
 }
 // The greedyData tuple contains the-rest-of-the-data
 

Note that the name of the fields are not configurable. They obey the punchplatform normalisation taxonomy. You are free of course to change them in your punchlet should you need other field names.

Constructor Summary

Constructors

Constructor and Description
SyslogHeaderOperator() This constructor is not meant to be called by applications.

Method Summary

Modifier and Type	Method and Description
boolean	into(Tuple header, Tuple data) Fire the operator.
SyslogHeaderOperator	on(String log)
SyslogHeaderOperator	on(Tuple log)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SyslogHeaderOperator

public SyslogHeaderOperator()

This constructor is not meant to be called by applications. It is provided using the Punchlet.syslogHeader() method call.

Method Detail

on

public SyslogHeaderOperator on(String log)

Parameters:

log - the input log to parse.

Returns:

this operator

on

public SyslogHeaderOperator on(Tuple log)

Parameters:

log - the input log to parse, given as a tuple. It is expected to contain a String leaf.

Returns:

this operator

into

public boolean into(Tuple header,
                    Tuple data)

Fire the operator.

Parameters:

header - the tuple holder for holding the parsed syslog header.

data - the tuple holder to contain the greedy data part of the log

Returns:

true if it worked. False otherwise.