Examples with Codec org.graylog2.plugin.inputs.codecs.Codec used on opensource projects

Example 6 with Codec

use of org.graylog2.plugin.inputs.codecs.Codec in project graylog2-server by Graylog2.

the class GelfCodecTest method decodeLargeCompressedMessageFails.

@Test
public void decodeLargeCompressedMessageFails() throws Exception {
    expectedException.expect(IllegalStateException.class);
    expectedException.expectMessage("JSON is null/could not be parsed (invalid JSON)");
    expectedException.expectCause(isA(JsonParseException.class));
    final Configuration configuration = new Configuration(Collections.singletonMap("decompress_size_limit", 100));
    final GelfCodec codec = new GelfCodec(configuration, aggregator);
    final String json = "{" + "\"version\": \"1.1\"," + "\"host\": \"example.org\"," + "\"short_message\": \"A short message that helps you identify what is going on\"," + "\"full_message\": \"Backtrace here\\n\\nMore stuff\"," + "\"timestamp\": 1385053862.3072," + "\"level\": 1," + "\"_some_bytes1\": \"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, \"," + "\"_some_bytes2\": \"sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, \"," + "\"_some_bytes2\": \"sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum.\"" + "}";
    final byte[] payload = TestHelper.zlibCompress(json);
    assumeTrue(payload.length > 100);
    final RawMessage rawMessage = new RawMessage(payload);
    codec.decode(rawMessage);
}

Example 7 with Codec

use of org.graylog2.plugin.inputs.codecs.Codec in project graylog2-server by Graylog2.

the class SyslogCodecTest method testDecodeStructuredIssue845WithExpandStructuredData.

@Test
public void testDecodeStructuredIssue845WithExpandStructuredData() throws Exception {
    when(configuration.getBoolean(SyslogCodec.CK_EXPAND_STRUCTURED_DATA)).thenReturn(true);
    final SyslogCodec codec = new SyslogCodec(configuration, metricRegistry);
    final Message message = codec.decode(buildRawMessage(STRUCTURED_ISSUE_845));
    assertNotNull(message);
    assertEquals(message.getMessage(), "User page 13 requested");
    assertEquals(((DateTime) message.getField("timestamp")).withZone(DateTimeZone.UTC), new DateTime("2015-01-06T20:56:33.287Z", DateTimeZone.UTC));
    assertEquals(message.getField("source"), "app-1");
    assertEquals(message.getField("level"), 6);
    assertEquals(message.getField("facility"), "local7");
    assertEquals(message.getField("mdc@18060_ip"), "::ffff:132.123.15.30");
    assertEquals(message.getField("mdc@18060_logger"), "{c.corp.Handler}");
    assertEquals(message.getField("mdc@18060_session"), "4ot7");
    assertEquals(message.getField("mdc@18060_user"), "user@example.com");
    assertEquals(message.getField("mdc@18060_user-agent"), "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/7.1.2 Safari/537.85.11");
    assertEquals(message.getField("application_name"), "app");
}

Example 8 with Codec

use of org.graylog2.plugin.inputs.codecs.Codec in project graylog2-server by Graylog2.

the class JournalDecode method runCommand.

@Override
protected void runCommand() {
    Range<Long> range;
    try {
        final List<String> offsets = Splitter.on("..").limit(2).splitToList(rangeArg);
        if (offsets.size() == 1) {
            range = Range.singleton(Long.valueOf(offsets.get(0)));
        } else if (offsets.size() == 2) {
            final String first = offsets.get(0);
            final String second = offsets.get(1);
            if (first.isEmpty()) {
                range = Range.atMost(Long.valueOf(second));
            } else if (second.isEmpty()) {
                range = Range.atLeast(Long.valueOf(first));
            } else {
                range = Range.closed(Long.valueOf(first), Long.valueOf(second));
            }
        } else {
            throw new RuntimeException();
        }
    } catch (Exception e) {
        System.err.println("Malformed offset range: " + rangeArg);
        return;
    }
    final Map<String, Codec.Factory<? extends Codec>> codecFactory = injector.getInstance(Key.get(new TypeLiteral<Map<String, Codec.Factory<? extends Codec>>>() {
    }));
    final Long readOffset = range.lowerEndpoint();
    final long count = range.upperEndpoint() - range.lowerEndpoint() + 1;
    final List<Journal.JournalReadEntry> entries = journal.read(readOffset, count);
    for (final Journal.JournalReadEntry entry : entries) {
        final RawMessage raw = RawMessage.decode(entry.getPayload(), entry.getOffset());
        if (raw == null) {
            System.err.println(MessageFormatter.format("Journal entry at offset {} failed to decode", entry.getOffset()));
            continue;
        }
        final Codec codec = codecFactory.get(raw.getCodecName()).create(raw.getCodecConfig());
        final Message message = codec.decode(raw);
        if (message == null) {
            System.err.println(MessageFormatter.format("Could not use codec {} to decode raw message id {} at offset {}", new Object[] { raw.getCodecName(), raw.getId(), entry.getOffset() }));
        } else {
            message.setJournalOffset(raw.getJournalOffset());
        }
        final ResolvableInetSocketAddress remoteAddress = raw.getRemoteAddress();
        final String remote = remoteAddress == null ? "unknown address" : remoteAddress.getInetSocketAddress().toString();
        final StringBuffer sb = new StringBuffer();
        sb.append("Message ").append(raw.getId()).append('\n').append(" at ").append(raw.getTimestamp()).append('\n').append(" in format ").append(raw.getCodecName()).append('\n').append(" at offset ").append(raw.getJournalOffset()).append('\n').append(" received from remote address ").append(remote).append('\n').append(" (source field: ").append(message == null ? "unparsed" : message.getSource()).append(')').append('\n');
        if (message != null) {
            sb.append(" contains ").append(message.getFieldNames().size()).append(" fields.");
        } else {
            sb.append("The message could not be parse by the given codec.");
        }
        System.out.println(sb);
    }
}