codecs/
gelf.rs

1//! Contains common definitions for GELF codec support
2
3use std::sync::LazyLock;
4
5use regex::Regex;
6use vrl::owned_value_path;
7use vrl::path::OwnedTargetPath;
8
9/// GELF Message fields. Definitions from <https://docs.graylog.org/docs/gelf>.
10pub mod gelf_fields {
11    /// (not a field) The latest version of the GELF specification.
12    pub const GELF_VERSION: &str = "1.1";
13
14    /// (required) GELF spec version
15    pub const VERSION: &str = "version";
16
17    /// (required) The name of the host, source or application that sent this message.
18    pub const HOST: &str = "host";
19
20    /// (required) A short descriptive message.
21    pub const SHORT_MESSAGE: &str = "short_message";
22
23    /// (optional) A long message that can i.e. contain a backtrace
24    pub const FULL_MESSAGE: &str = "full_message";
25
26    /// (optional) Seconds since UNIX epoch with optional decimal places for milliseconds.
27    ///  SHOULD be set by client library. Will be set to the current timestamp (now) by the server if absent.
28    pub const TIMESTAMP: &str = "timestamp";
29
30    /// (optional) The level equal to the standard syslog levels. default is 1 (ALERT).
31    pub const LEVEL: &str = "level";
32
33    /// (optional) (deprecated) Send as additional field instead.
34    pub const FACILITY: &str = "facility";
35
36    /// (optional) (deprecated) The line in a file that caused the error (decimal). Send as additional field instead.
37    pub const LINE: &str = "line";
38
39    /// (optional) (deprecated) The file (with path if you want) that caused the error. Send as additional field instead.
40    pub const FILE: &str = "file";
41
42    // < Every field with an underscore (_) prefix will be treated as an additional field. >
43}
44
45/// GELF owned target paths.
46pub(crate) struct GelfTargetPaths {
47    pub version: OwnedTargetPath,
48    pub host: OwnedTargetPath,
49    pub full_message: OwnedTargetPath,
50    pub level: OwnedTargetPath,
51    pub facility: OwnedTargetPath,
52    pub line: OwnedTargetPath,
53    pub file: OwnedTargetPath,
54    pub short_message: OwnedTargetPath,
55}
56
57/// Lazily initialized singleton.
58pub(crate) static GELF_TARGET_PATHS: LazyLock<GelfTargetPaths> =
59    LazyLock::new(|| GelfTargetPaths {
60        version: OwnedTargetPath::event(owned_value_path!(gelf_fields::VERSION)),
61        host: OwnedTargetPath::event(owned_value_path!(gelf_fields::HOST)),
62        full_message: OwnedTargetPath::event(owned_value_path!(gelf_fields::FULL_MESSAGE)),
63        level: OwnedTargetPath::event(owned_value_path!(gelf_fields::LEVEL)),
64        facility: OwnedTargetPath::event(owned_value_path!(gelf_fields::FACILITY)),
65        line: OwnedTargetPath::event(owned_value_path!(gelf_fields::LINE)),
66        file: OwnedTargetPath::event(owned_value_path!(gelf_fields::FILE)),
67        short_message: OwnedTargetPath::event(owned_value_path!(gelf_fields::SHORT_MESSAGE)),
68    });
69
70/// Regex for matching valid field names in the encoder. According to the original spec by graylog,
71/// must contain only word chars, periods and dashes. Additional field names must also be prefixed
72/// with an `_` , however that is intentionally omitted from this regex to be checked separately
73/// to create a specific error message.
74/// As Graylog itself will produce GELF with any existing field names on the Graylog GELF Output,
75/// vector is more lenient, too, at least allowing the additional `@` character.
76pub static VALID_FIELD_REGEX: LazyLock<Regex> =
77    LazyLock::new(|| Regex::new(r"^[\w\.\-@]*$").unwrap());
codecs/gelf.rs

codecs/
gelf.rs
