Documentation
¶
Overview ¶
Package parser provides log parsers that convert raw log lines into structured Events.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ApacheErrorParser ¶
type ApacheErrorParser struct {
// contains filtered or unexported fields
}
ApacheErrorParser parses Apache HTTP Server error_log lines into "http_error" Events.
Sources handled: any source prefixed "apache-error:", and well-known Apache error_log paths ("/apache2/error" or "/httpd/error" substring).
func NewApacheErrorParser ¶
func NewApacheErrorParser(logger *slog.Logger) *ApacheErrorParser
NewApacheErrorParser creates an ApacheErrorParser that writes debug messages to logger.
func (*ApacheErrorParser) Matches ¶
func (p *ApacheErrorParser) Matches(source string) bool
Matches reports whether this parser handles the given collector source ID.
type CaddyConfig ¶
type CaddyConfig struct {
// TrustedProxies lists CIDR ranges whose connecting IP may be overridden
// by the X-Forwarded-For header. Empty means XFF is never trusted.
TrustedProxies []netip.Prefix
}
CaddyConfig holds optional configuration for CaddyParser.
type CaddyParser ¶
type CaddyParser struct {
// contains filtered or unexported fields
}
CaddyParser parses Caddy v2 access log lines in JSON (primary) or CLF format. It implements sdk.Parser.
Sources handled: "journald:caddy", any source path containing "/caddy/", any source prefixed with "caddy:".
func NewCaddyParser ¶
func NewCaddyParser(logger *slog.Logger, cfg CaddyConfig) *CaddyParser
NewCaddyParser creates a CaddyParser that writes debug messages to logger.
func (*CaddyParser) Matches ¶
func (p *CaddyParser) Matches(source string) bool
Matches reports whether this parser handles the given collector source ID.
type NginxConfig ¶
type NginxConfig struct {
// TrustedProxies lists CIDR ranges whose connecting IP may be overridden
// by the X-Forwarded-For header. Empty means XFF is never trusted.
TrustedProxies []netip.Prefix
// CustomFormats are additional log-format regexes tried after "combined"
// fails. See the NginxConfig doc for required named capture groups.
CustomFormats []*regexp.Regexp
}
NginxConfig holds optional configuration for NginxParser.
Adding a custom log format ¶
Compile a *regexp.Regexp with named capture groups and append it to CustomFormats. Required groups: remote_addr, method, path, status, bytes. Optional groups: ua (User-Agent), xff (X-Forwarded-For value).
Example (nginx "common" format without referer/UA):
pat := regexp.MustCompile(
`^(?P<remote_addr>\S+)\s+\S+\s+\S+\s+\[[^\]]+\]\s+"(?P<method>[A-Z]{1,16})\s+(?P<path>\S+)\s+\S+"\s+(?P<status>\d{1,3})\s+(?P<bytes>\d+|-)`)
cfg := parser.NginxConfig{CustomFormats: []*regexp.Regexp{pat}}
type NginxParser ¶
type NginxParser struct {
// contains filtered or unexported fields
}
NginxParser parses nginx access log lines in "combined" format, JSON format, or user-supplied custom formats (see NginxConfig). It implements sdk.Parser.
Sources handled: "journald:nginx", any source path containing "/nginx/", any source prefixed with "nginx:" or "apache:" (Apache shares the combined access log format).
func NewNginxParser ¶
func NewNginxParser(logger *slog.Logger, cfg NginxConfig) *NginxParser
NewNginxParser creates a NginxParser that writes debug messages to logger.
func (*NginxParser) Matches ¶
func (p *NginxParser) Matches(source string) bool
Matches reports whether this parser handles the given collector source ID. Apache uses the same "combined" access log format as nginx, so collectors with parser: apache (source prefix "apache:") are handled here as well.
type SSHParser ¶
type SSHParser struct {
// contains filtered or unexported fields
}
SSHParser parses SSH authentication log lines from any distribution and collection method:
- journald units: "journald:ssh" (Debian/Ubuntu), "journald:sshd" (RHEL/CentOS/Fedora/Arch/SUSE), "journald:sshd-session", each with or without a ".service" suffix.
- file logs: any path ending in "auth.log" (Debian/Ubuntu) or "/secure" (RHEL family), as "file:<path>" or a bare path.
- an explicit "ssh:" parser override (parser: ssh in a collector).
Both the RFC3164 ("Jan 1 12:00:00") and RFC3339/ISO-8601 ("2026-07-13T22:57:35.182105+00:00") syslog prefixes are recognised, as are prefix-less messages (journald "-o cat").
func NewSSHParser ¶
NewSSHParser creates an SSHParser that writes debug messages to logger.
func (*SSHParser) Matches ¶
Matches reports whether this parser handles the given collector source ID.
The SSH systemd unit is "ssh" on Debian/Ubuntu but "sshd" on the RHEL family, Arch and SUSE; both (and the OpenSSH 9.6+ "sshd-session" identifier) are accepted, with or without a ".service" suffix. An explicit override for a different parser (e.g. "nginx:<path>") is never claimed, so routing stays deterministic.
type TraefikConfig ¶
type TraefikConfig struct {
// TrustedProxies lists CIDR ranges whose connecting IP may be overridden
// by the X-Forwarded-For header. Empty means XFF is never trusted.
TrustedProxies []netip.Prefix
}
TraefikConfig holds optional configuration for TraefikParser.
type TraefikParser ¶
type TraefikParser struct {
// contains filtered or unexported fields
}
TraefikParser parses Traefik access log lines in CLF (with router/service/ duration extras) or JSON format. It implements sdk.Parser.
Sources handled: "journald:traefik", any source path containing "/traefik/", any source prefixed with "traefik:".
func NewTraefikParser ¶
func NewTraefikParser(logger *slog.Logger, cfg TraefikConfig) *TraefikParser
NewTraefikParser creates a TraefikParser that writes debug messages to logger.
func (*TraefikParser) Matches ¶
func (p *TraefikParser) Matches(source string) bool
Matches reports whether this parser handles the given collector source ID.
Source Files