nellemann/syslogd
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases 3 Wiki Activity

Work on detecting chunked messages.

Browse source
This commit is contained in:
Mark Nellemann 2022-12-13 09:14:21 +01:00
parent 4cb04bd687
commit 4cc11b0587
1 changed files with 31 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
src/main/java/biz/nellemann/syslogd/parser/GelfParser.java
View file

@ -9,6 +9,7 @@ import org.slf4j.LoggerFactory;
import java.io.UnsupportedEncodingException; import java.io.UnsupportedEncodingException;
import java.time.Instant; import java.time.Instant;
import java.util.Arrays;
import java.util.zip.DataFormatException; import java.util.zip.DataFormatException;
public class GelfParser extends SyslogParser { public class GelfParser extends SyslogParser {
@ -54,18 +55,38 @@ public class GelfParser extends SyslogParser {
@Override @Override
public SyslogMessage parse(byte[] input) { public SyslogMessage parse(byte[] input) {
String text = null;
if(input[0] == (byte)0x78 && input[1] == (byte)0x9c) { // Compressed data - TODO: better detection ? if(input.length < 8) return null; // TODO: Find proper minimum input length ?
try { String text;
text = decompress(input);
} catch (DataFormatException | UnsupportedEncodingException e) { // GELF Magic Bytes: 0x1e 0x0f
log.error("parse() - error: {}", e.getMessage()); if(input[0] == (byte)0x1e && input[1] == (byte)0x0f) {
} /*
} else { Message ID - 8 bytes: Must be the same for every chunk of this message.
text = byteArrayToString(input); Identifies the whole message and is used to reassemble the chunks later.
Generate from millisecond timestamp + hostname, for example.
Sequence number - 1 byte: The sequence number of this chunk starts at 0 and is always less than the sequence count.
Sequence count - 1 byte: Total number of chunks this message has.
All chunks MUST arrive within 5 seconds or the server will discard all chunks that have arrived or are in the process of arriving. A message MUST NOT consist of more than 128 chunks.
*/
log.warn("parse() - Found Magic Bytes, can't parse yet.");
byte[] newInput = Arrays.copyOfRange(input, 12, input.length);
//return parse(byteArrayToString(newInput));
return null;
} }
return parse(text); // Compressed data: 0x78 0x9c
if(input[0] == (byte)0x78 && input[1] == (byte)0x9c) { // TODO: better detection ?
try {
return parse(decompress(input));
} catch (DataFormatException | UnsupportedEncodingException e) {
log.error("parse() - error: {}", e.getMessage());
return null;
}
}
return parse(byteArrayToString(input));
} }