org.thales.punch.libraries.storm.bolt

Class SyslogUdpOutput

java.lang.Object

org.thales.punch.libraries.storm.api.BaseProcessingNode

org.thales.punch.libraries.storm.bolt.SyslogUdpOutput

All Implemented Interfaces:

Serializable, org.apache.storm.task.IBolt, org.apache.storm.topology.IComponent, org.apache.storm.topology.IRichBolt

public class SyslogUdpOutput
extends org.thales.punch.libraries.storm.api.BaseProcessingNode

The Syslog udp bolt forwards messages to a next hop UDP server. It is a terminating bolt, i.e. it does not forwards the tuple further the topology.

Overview

This bolt uses a single socket per configured destination.

The SyslogBolt can forward the data either forwards the input (storm) tuple transformed as a String. On the PunchPlatform, that means a String representation of a Json document of the form :

 { "storm stream id" : { "storm field id 1" : { "key : value ...}, "storm field id 2" : { "key : value ...} , ...} 
 

For example on a log management PunchPlatform you have something like :

 
 { "logs" : { "log" : { "message" : "original log" , "vendor" : "apache" ...}}
 

Often what you need is to forward another format, and/or to filter out some unnecessary fields. To do that you must insert a PunchBolt before this SyslogBolt. For example here is a punchlet that transform the (Json) log into a plain key-value string:

 
  {
         // get the Json under the stream and field id. 
         Tuple input = root:[logs][log];
         // transform it into a key value string
         String kv = toKv().on(input);
         // replace the input document by that String.
         root:[logs][log] = kv;
  }
  

With such a punchlet, the bolt will send something like

 
  "message"="original log", "vendor"="apache" ...
 

Bolt level settings

Here is an example of a typical configuration :

 
   {
           "type" : "syslog_bolt",
           "bolt_settings" : {
              "destination" : [
                { "host" : "127.0.0.1", "port" : 8888 }
              ]
           },
           "storm_settings" : {
                "executors": 1
           }
      }
 

Destination Settings

Each destination takes the following properties

property	mandatory	type	default	comment
host	yes	string	-	The server host address. Accepted values are dotted number IP addresses, or hostname. You can set several destination addresses using the destination property.
port	yes	int	-	The server listening port.

See Also:

Serialized Form

Field Summary

Fields inherited from class org.thales.punch.libraries.storm.api.BaseProcessingNode

ackRate, collector, componentId, every, failRate, metricContext, nodeSettings, topologyContext, traversalTime

Constructor Summary

Constructors

Constructor and Description
SyslogUdpOutput(org.thales.punch.libraries.storm.api.NodeSettings config) Public constructor.

Method Summary

Modifier and Type	Method and Description
void	declareOutputFields(org.apache.storm.topology.OutputFieldsDeclarer declarer)
void	prepare(Map map, org.apache.storm.task.TopologyContext topologyContext, org.apache.storm.task.OutputCollector collector) Setup this spout before starting emitting Tuples into the topology.
void	process(org.apache.storm.tuple.Tuple tuple) The Syslog bolt expects a single field, and forwards that field to the destination.

Methods inherited from class org.thales.punch.libraries.storm.api.BaseProcessingNode

ack, cleanup, enrichAndForwardMonitoringTuple, execute, fail, getComponentConfiguration, getNewPoint

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SyslogUdpOutput

public SyslogUdpOutput(org.thales.punch.libraries.storm.api.NodeSettings config)

Public constructor. A Spout ctor is in charge of setting the fields that will be required later on when the bolt will be effectively started and run somewhere in the cluster. Each field set here must be serializable.

Parameters:

config - the config

Method Detail

prepare

public void prepare(Map map,
                    org.apache.storm.task.TopologyContext topologyContext,
                    org.apache.storm.task.OutputCollector collector)

Setup this spout before starting emitting Tuples into the topology. This is called by the Storm runtime at activation.

Specified by:

prepare in interface org.apache.storm.task.IBolt

Overrides:

prepare in class org.thales.punch.libraries.storm.api.BaseProcessingNode

Parameters:

map - the storm settings

topologyContext - the topology settingss

collector - the output collector for sending out tuples.

process

public void process(org.apache.storm.tuple.Tuple tuple)

The Syslog bolt expects a single field, and forwards that field to the destination. If several fields are received, it sends a key-value format field1=value1 field2=value2.

Specified by:

process in class org.thales.punch.libraries.storm.api.BaseProcessingNode

Parameters:

tuple - the tuple to send

declareOutputFields

public void declareOutputFields(org.apache.storm.topology.OutputFieldsDeclarer declarer)

Specified by:

declareOutputFields in interface org.apache.storm.topology.IComponent

Overrides:

declareOutputFields in class org.thales.punch.libraries.storm.api.BaseProcessingNode