Class: LogStash::Inputs::Heroku

Inherits:
Base show all
Defined in:
lib/logstash/inputs/heroku.rb

Overview

Stream events from a heroku app’s logs.

This will read events in a manner similar to how the ‘heroku logs -t` command fetches logs.

Recommended filters:

filter {
  grok {
    pattern => "^%{TIMESTAMP_ISO8601:timestamp} %{WORD:component}\[%{WORD:process}(?:\.%{INT:instance:int})?\]: %{DATA:message}$"
  }
  date { timestamp => ISO8601 }
}

Constant Summary

Constants included from Config::Mixin

Config::Mixin::CONFIGSORT

Instance Attribute Summary

Attributes inherited from Base

#params, #threadable

Attributes included from Config::Mixin

#config, #original_params

Attributes inherited from Plugin

#logger, #params

Instance Method Summary collapse

Methods inherited from Base

#initialize, #tag

Methods included from Config::Mixin

#config_init, included

Methods inherited from Plugin

#eql?, #finished, #finished?, #hash, #initialize, #inspect, lookup, #reload, #running?, #shutdown, #teardown, #terminating?, #to_s

Constructor Details

This class inherits a constructor from LogStash::Inputs::Base

Instance Method Details

#register ⇒ Object 



29
30
31
32
 
# File 'lib/logstash/inputs/heroku.rb', line 29

def register
  require "heroku"
  require "logstash/util/buftok"
end

#run(queue) ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/logstash/inputs/heroku.rb', line 35

def run(queue)
  client = Heroku::Client.new(Heroku::Auth.user, Heroku::Auth.password)

  # The 'Herok::Client#read_logs' method emits chunks of text not bounded
  # by event barriers like newlines.
  # tail=1 means to follow logs
  # I *think* setting num=1 means we only get 1 historical event. Setting
  # this to 0 makes it fetch *all* events, not what I want.
  client.read_logs(@app, ["tail=1", "num=1"]) do |chunk|
    @codec.decode(chunk) do |event|
      decorate(event)
      event["app"] = @app
      queue << event
    end
  end
end