Additional delimiter for messages

[eloo]

Hello,

i'm testing your library right now to use it together with a fluentD stack and it looks like we could need an additional delimiter to the fired messages.

So would it be possible to configure an additional delimiter for the hook? For example a nullcharacter?
This could be easily done like this

func (f LogstashFormatter) Format(e *logrus.Entry) ([]byte, error) {
    ne := copyEntry(e, f.Fields)
    dataBytes, err := f.Formatter.Format(ne)
    releaseEntry(ne)
    dataBytes = append(dataBytes, []byte("\000")...)
    return dataBytes, err
}

What do you think about it?

Thanks
eloo

[boaz0]

Hi @eloo 👋,

Thanks for your ticket but just a small question:
Is that delimiter necessary for fluentd or logstash?

What I mean is why do you need to append \000 to the end of each entry?

Thanks.

[eloo]

Hi @boaz0,
i'm not sure if this is related to the fluentd or logstash more to the tcp server implementation we are using.
Its a cool.io ruby server where we need to set a specific delimiter which is in our case a null byte.
So without this specific delimiter the tcp server doesn't recognise the start and end of the message properly.

Thanks

[boaz0]

Hi @eloo

In order to append characters to the formatted message you can do the following thing:

1. Create a customized writer

type SuffixAppender struct {
  nextWriter io.Writer
}

func (sa SuffixAppender) Write(dataBytes []byte) (int, error) {
  newData := append(dataBytes, []byte("\n")...)
  n, err := sa.nextWriter.Write(newData)
  return n, err
}

2. Then when setting a new logrustash instance create SuffixAppender and pass it to New as writer.
   For example, in order to print to stdout do the following:

  log := logrus.New()
  sout := SuffixAppender{nextWriter: os.Stdout}
  hook := logrustash.New(sout, logrustash.DefaultFormatter(...))

Does that solve your problem?

[eloo]

@boaz0
Thanks for this snippet.
Its working perfectly 👍
Just need to exchange the \n with my \000.

Thanks!

[boaz0]

Thanks @eloo

I will add this to the docs and close it once it's merged.

Best regards.

[eloo]

sounds good.
Thanks