papertrail

README

papertrail webhooks

Enables Telegraf to act as a Papertrail Webhook.

Events

Full documentation.

Events from Papertrail come in two forms:

• The event-based callback:

  • A point is created per event, with the timestamp as received_at
  • Each point has a field counter (count), which is set to 1 (signifying the event occurred)
  • Each event "hostname" object is converted to a host tag
  • The "saved_search" name in the payload is added as an event tag

• The count-based callback

  • A point is created per timeseries object per count, with the timestamp as the "timeseries" key (the unix epoch of the event)
  • Each point has a field counter (count), which is set to the value of each "timeseries" object
  • Each count "source_name" object is converted to a host tag
  • The "saved_search" name in the payload is added as an event tag

The current functionality is very basic, however this allows you to track the number of events by host and saved search.

When an event is received, any point will look similar to:

papertrail,host=myserver.example.com,event=saved_search_name count=3i 1453248892000000000

Documentation

Index

• type Count
• type Event
• type PapertrailWebhook
  • func (pt *PapertrailWebhook) Register(router *mux.Router, acc telegraf.Accumulator)
• type Payload
• type SavedSearch

Types

type Count

type Count struct {
	SourceName string            `json:"source_name"`
	SourceID   int64             `json:"source_id"`
	TimeSeries *map[int64]uint64 `json:"timeseries"`
}

type Event

type Event struct {
	ID                int64     `json:"id"`
	ReceivedAt        time.Time `json:"received_at"`
	DisplayReceivedAt string    `json:"display_received_at"`
	SourceIP          string    `json:"source_ip"`
	SourceName        string    `json:"source_name"`
	SourceID          int       `json:"source_id"`
	Hostname          string    `json:"hostname"`
	Program           string    `json:"program"`
	Severity          string    `json:"severity"`
	Facility          string    `json:"facility"`
	Message           string    `json:"message"`
}

type PapertrailWebhook

type PapertrailWebhook struct {
	Path string
	// contains filtered or unexported fields
}

func (*PapertrailWebhook) Register

func (pt *PapertrailWebhook) Register(router *mux.Router, acc telegraf.Accumulator)

type Payload

type Payload struct {
	Events      []*Event     `json:"events"`
	Counts      []*Count     `json:"counts"`
	SavedSearch *SavedSearch `json:"saved_search"`
	MaxID       string       `json:"max_id"`
	MinID       string       `json:"min_id"`
}

type SavedSearch

type SavedSearch struct {
	ID        int64  `json:"id"`
	Name      string `json:"name"`
	Query     string `json:"query"`
	EditURL   string `json:"html_edit_url"`
	SearchURL string `json:"html_search_url"`
}