Examples with RawMessage org.graylog2.plugin.journal.RawMessage used on opensource projects

Example 6 with RawMessage

use of org.graylog2.plugin.journal.RawMessage in project graylog2-server by Graylog2.

the class NetFlowCodec method decodeMessages.

@Nullable
@Override
public Collection<Message> decodeMessages(@Nonnull RawMessage rawMessage) {
    try {
        final ResolvableInetSocketAddress remoteAddress = rawMessage.getRemoteAddress();
        final InetSocketAddress sender = remoteAddress != null ? remoteAddress.getInetSocketAddress() : null;
        final byte[] payload = rawMessage.getPayload();
        if (payload.length < 3) {
            LOG.debug("NetFlow message (source: {}) doesn't even fit the NetFlow version (size: {} bytes)", sender, payload.length);
            return null;
        }
        final ByteBuf buffer = Unpooled.wrappedBuffer(payload);
        switch(buffer.readByte()) {
            case PASSTHROUGH_MARKER:
                final NetFlowV5Packet netFlowV5Packet = NetFlowV5Parser.parsePacket(buffer);
                return netFlowV5Packet.records().stream().map(record -> NetFlowFormatter.toMessage(netFlowV5Packet.header(), record, sender)).collect(Collectors.toList());
            case ORDERED_V9_MARKER:
                // our "custom" netflow v9 that has all the templates in the same packet
                return decodeV9(sender, buffer);
            default:
                final List<RawMessage.SourceNode> sourceNodes = rawMessage.getSourceNodes();
                final RawMessage.SourceNode sourceNode = sourceNodes.isEmpty() ? null : sourceNodes.get(sourceNodes.size() - 1);
                final String inputId = sourceNode == null ? "<unknown>" : sourceNode.inputId;
                LOG.warn("Unsupported NetFlow packet on input {} (source: {})", inputId, sender);
                return null;
        }
    } catch (FlowException e) {
        LOG.error("Error parsing NetFlow packet <{}> received from <{}>", rawMessage.getId(), rawMessage.getRemoteAddress(), e);
        if (LOG.isDebugEnabled()) {
            LOG.debug("NetFlow packet hexdump:\n{}", ByteBufUtil.prettyHexDump(Unpooled.wrappedBuffer(rawMessage.getPayload())));
        }
        return null;
    } catch (InvalidProtocolBufferException e) {
        LOG.error("Invalid NetFlowV9 entry found, cannot parse the messages", ExceptionUtils.getRootCause(e));
        return null;
    }
}

Example 7 with RawMessage

use of org.graylog2.plugin.journal.RawMessage in project graylog2-server by Graylog2.

the class AbstractTcpTransport method getChildChannelHandlers.

@Override
protected LinkedHashMap<String, Callable<? extends ChannelHandler>> getChildChannelHandlers(MessageInput input) {
    final LinkedHashMap<String, Callable<? extends ChannelHandler>> handlers = new LinkedHashMap<>();
    final CodecAggregator aggregator = getAggregator();
    handlers.put("channel-registration", () -> new ChannelRegistrationHandler(childChannels));
    handlers.put("traffic-counter", () -> throughputCounter);
    handlers.put("connection-counter", () -> connectionCounter);
    if (tlsEnable) {
        LOG.info("Enabled TLS for input [{}/{}]. key-file=\"{}\" cert-file=\"{}\"", input.getName(), input.getId(), tlsKeyFile, tlsCertFile);
        handlers.put("tls", getSslHandlerCallable(input));
    }
    handlers.putAll(getCustomChildChannelHandlers(input));
    if (aggregator != null) {
        LOG.debug("Adding codec aggregator {} to channel pipeline", aggregator);
        handlers.put("codec-aggregator", () -> new ByteBufMessageAggregationHandler(aggregator, localRegistry));
    }
    handlers.put("rawmessage-handler", () -> new RawMessageHandler(input));
    handlers.put("exception-logger", () -> new ExceptionLoggingChannelHandler(input, LOG, this.tcpKeepalive));
    return handlers;
}

Example 8 with RawMessage

use of org.graylog2.plugin.journal.RawMessage in project graylog2-server by Graylog2.

the class RawMessage method encode.

public byte[] encode() {
    try {
        final JournalMessages.CodecInfo codec = msgBuilder.getCodec();
        final JournalMessages.CodecInfo.Builder builder = JournalMessages.CodecInfo.newBuilder(codec);
        final String codecConfigJson = codecConfig.serializeToJson();
        if (codecConfigJson != null) {
            builder.setConfig(codecConfigJson);
        }
        msgBuilder.setCodec(builder.build());
        final JournalMessage journalMessage = msgBuilder.build();
        return journalMessage.toByteArray();
    } catch (UninitializedMessageException e) {
        log.error("Unable to write RawMessage to journal because required fields are missing, " + "this message will be discarded. This is a bug.", e);
        return null;
    }
}

Example 9 with RawMessage

use of org.graylog2.plugin.journal.RawMessage in project graylog2-server by Graylog2.

the class RawMessageHandler method channelRead0.

@Override
protected void channelRead0(ChannelHandlerContext ctx, ByteBuf msg) throws Exception {
    final byte[] bytes = new byte[msg.readableBytes()];
    msg.readBytes(bytes);
    final RawMessage raw = new RawMessage(bytes, (InetSocketAddress) ctx.channel().remoteAddress());
    input.processRawMessage(raw);
}

Example 10 with RawMessage

use of org.graylog2.plugin.journal.RawMessage in project graylog2-server by Graylog2.

the class JsonPathCodec method decode.

@Nullable
@Override
public Message decode(@Nonnull RawMessage rawMessage) {
    if (jsonPath == null) {
        return null;
    }
    final String json = new String(rawMessage.getPayload(), StandardCharsets.UTF_8);
    final Map<String, Object> fields = read(json);
    final Message message = new Message(buildShortMessage(fields), configuration.getString(CK_SOURCE), rawMessage.getTimestamp());
    message.addFields(fields);
    return message;
}