diff --git a/lib/fluent/plugin/out_remote_syslog.rb b/lib/fluent/plugin/out_remote_syslog.rb index 2409525..4f51208 100644 --- a/lib/fluent/plugin/out_remote_syslog.rb +++ b/lib/fluent/plugin/out_remote_syslog.rb @@ -96,6 +96,8 @@ def write(chunk) program = extract_placeholders(@program, chunk.metadata) hostname = extract_placeholders(@hostname, chunk.metadata) + severity = SeverityMapper.map(severity) + packet_options = {facility: facility, severity: severity, program: program} packet_options[:hostname] = hostname unless hostname.empty? @@ -149,6 +151,22 @@ def create_sender(host, port) @senders << sender sender end + + # Convert some Severity values that is not supported in `syslog_protocol` library: + # https://github.com/eric/syslog_protocol + # We want to fix `syslog_protocol` itself, but it seems to be not maintained for a while. + # If the following PR is merged, we can remove this implementaion. + # https://github.com/eric/syslog_protocol/pull/9 + module SeverityMapper + DICT = { + # "warning" is not supported, but we should use it since "warn" is deprecated. + "warning" => "warn", + } + + def self.map(severity) + DICT[severity] || severity + end + end end end end diff --git a/test/plugin/out_remote_syslog.rb b/test/plugin/out_remote_syslog.rb index b6a779e..4ae18bf 100644 --- a/test/plugin/out_remote_syslog.rb +++ b/test/plugin/out_remote_syslog.rb @@ -81,4 +81,19 @@ def test_write_tcp d.feed("tag", Fluent::EventTime.now, {"message" => "foo"}) end end + + data("emerg", {in: "emerg", out: "emerg"}) + data("alert", {in: "alert", out: "alert"}) + data("crit", {in: "crit", out: "crit"}) + data("err", {in: "err", out: "err"}) + data("warn", {in: "warn", out: "warn"}) + data("warning", {in: "warning", out: "warn"}) + data("notice", {in: "notice", out: "notice"}) + data("info", {in: "info", out: "info"}) + data("debug", {in: "debug", out: "debug"}) + data("wrong", {in: "wrong", out: "wrong"}) + def test_severity_mapper(data) + out = Fluent::Plugin::RemoteSyslogOutput::SeverityMapper.map(data[:in]) + assert_equal(data[:out], out) + end end