Skip to content

Commit

Permalink
[Journalbeat] Improve parsing of syslog.pid in journalbeat to strip t…
Browse files Browse the repository at this point in the history
…he username when present (elastic#16116)

* Improve parsing of syslog.pid in journalbeat to strip the username in pid when present.

* Add entry to changelog with pull ID.

* Improve the comment on the username strip.

(cherry picked from commit 6a7dbd6)
  • Loading branch information
blakerouse committed Feb 10, 2020
1 parent a8a3208 commit 4be3dd6
Show file tree
Hide file tree
Showing 3 changed files with 51 additions and 2 deletions.
2 changes: 2 additions & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
*Journalbeat*

- Remove broken dashboard. {pull}15288[15288]
- Improve parsing of syslog.pid in journalbeat to strip the username when present {pull}16116[16116]


*Metricbeat*

Expand Down
12 changes: 10 additions & 2 deletions journalbeat/reader/journal.go
Original file line number Diff line number Diff line change
Expand Up @@ -288,8 +288,16 @@ func (r *Reader) convertNamedField(fc fieldConversion, value string) interface{}
if fc.isInteger {
v, err := strconv.ParseInt(value, 10, 64)
if err != nil {
r.logger.Debugf("Failed to convert field: %s \"%v\" to int: %v", fc.name, value, err)
return value
// On some versions of systemd the 'syslog.pid' can contain the username
// appended to the end of the pid. In most cases this does not occur
// but in the cases that it does, this tries to strip ',\w*' from the
// value and then perform the conversion.
s := strings.Split(value, ",")
v, err = strconv.ParseInt(s[0], 10, 64)
if err != nil {
r.logger.Debugf("Failed to convert field: %s \"%v\" to int: %v", fc.name, value, err)
return value
}
}
return v
}
Expand Down
39 changes: 39 additions & 0 deletions journalbeat/reader/journal_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,45 @@ func TestToEvent(t *testing.T) {
},
},
},
// 'syslog.pid' field without user append
ToEventTestCase{
entry: sdjournal.JournalEntry{
Fields: map[string]string{
sdjournal.SD_JOURNAL_FIELD_SYSLOG_PID: "123456",
},
},
expectedFields: common.MapStr{
"syslog": common.MapStr{
"pid": int64(123456),
},
},
},
// 'syslog.pid' field with user append
ToEventTestCase{
entry: sdjournal.JournalEntry{
Fields: map[string]string{
sdjournal.SD_JOURNAL_FIELD_SYSLOG_PID: "123456,root",
},
},
expectedFields: common.MapStr{
"syslog": common.MapStr{
"pid": int64(123456),
},
},
},
// 'syslog.pid' field empty
ToEventTestCase{
entry: sdjournal.JournalEntry{
Fields: map[string]string{
sdjournal.SD_JOURNAL_FIELD_SYSLOG_PID: "",
},
},
expectedFields: common.MapStr{
"syslog": common.MapStr{
"pid": "",
},
},
},
// custom field
ToEventTestCase{
entry: sdjournal.JournalEntry{
Expand Down

0 comments on commit 4be3dd6

Please sign in to comment.