This looks like a pretty straight-forward syslog message, have you tried the rsyslog decoder[1]?
If you need to do further processing past the initial rsyslog decoding, a custom decoder that still uses the syslog module to do the initial grammar parsing before further processing works pretty well, which is how i set up our haproxy syslog decoder[2], which borrows from the rsyslog decoder for most of the process_message function. [1]: http://hekad.readthedocs.org/en/v0.9.2/config/decoders/rsyslog.html [2]: https://gist.github.com/nathwill/b7a56458b0959f62e7ac On Wed, Oct 21, 2015 at 11:23 AM, Justin Vogt <justin.vog...@gmail.com> wrote: > Hello Heka Community, > > I’m getting a weird error… I’ve written a custom decoder in Lua, and it > works find when I test it on the LPEG grammar tester, but when I try to run > it in Heka, I continually get a “Decoder error, failed parsing” message. > I’ve tried just about everything I can think of and have been pulling my > hair out to figure out the issue. Any help would be greatly appreciated!! > > > Here's the grammar > > local l = require "lpeg" > > local dt = require "date_time" > > local sp = l.space > > l.locale(l) > > local pri = l.P"<" * lpeg.Cg(lpeg.R"09"^0, "pri") * lpeg.P">" > > local logtime = l.Cg(dt.build_strftime_grammar("%b %d %X"), "logtime") * sp > > local hostname = l.Cg((1 - sp)^1, "hostname") * sp > > local logname = l.Cg((1 - sp)^1, "logname") * sp > > local message = l.Cg(l.P(1)^0, "message") > > msg = pri * logtime * hostname * logname * message > > grammar = l.Ct(msg) > > > And a sample log line: > > <14>Oct 16 02:26:17 node-85 keystone-all 192.168.0.2 - - [16/Oct/2015 > 02:26:17] "GET /v3/auth/tokens HTTP/1.1" 200 10162 0.125928 > > > I can literally copy and paste the grammar out of the decoder and the log > line from the failed parse message into the LPEG tester and it works. > > > Thanks in advance! > > _______________________________________________ > Heka mailing list > Heka@mozilla.org > https://mail.mozilla.org/listinfo/heka > >
_______________________________________________ Heka mailing list Heka@mozilla.org https://mail.mozilla.org/listinfo/heka