Add optional syslog logrus hook (#343)

* add optional syslog logrus hook

* document syslog

vendor/gopkg.in/mcuadros/go-syslog.v2/format/automatic.go

@@ -0,0 +1,104 @@
+package format
+
+import (
+	"bufio"
+	"bytes"
+	"strconv"
+
+	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser/rfc3164"
+	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser/rfc5424"
+)
+
+/* Selecting an 'Automatic' format detects incoming format (i.e. RFC3164 vs RFC5424) and Framing
+ * (i.e. RFC6587 s3.4.1 octet counting as described here as RFC6587, and either no framing or
+ * RFC6587 s3.4.2 octet stuffing / non-transparent framing, described here as either RFC3164
+ * or RFC6587).
+ *
+ * In essence if you don't know which format to select, or have multiple incoming formats, this
+ * is the one to go for. There is a theoretical performance penalty (it has to look at a few bytes
+ * at the start of the frame), and a risk that you may parse things you don't want to parse
+ * (rogue syslog clients using other formats), so if you can be absolutely sure of your syslog
+ * format, it would be best to select it explicitly.
+ */
+
+type Automatic struct{}
+
+const (
+	detectedUnknown = iota
+	detectedRFC3164 = iota
+	detectedRFC5424 = iota
+	detectedRFC6587 = iota
+)
+
+/*
+ * Will always fallback to rfc3164 (see section 4.3.3)
+ */
+func detect(data []byte) int {
+	// all formats have a sapce somewhere
+	if i := bytes.IndexByte(data, ' '); i > 0 {
+		pLength := data[0:i]
+		if _, err := strconv.Atoi(string(pLength)); err == nil {
+			return detectedRFC6587
+		}
+		// are we starting with <
+		if data[0] != '<' {
+			return detectedRFC3164
+		}
+		// is there a close angle bracket before the ' '? there should be
+		angle := bytes.IndexByte(data, '>')
+		if (angle < 0) || (angle >= i) {
+			return detectedRFC3164
+		}
+
+		// if a single digit immediately follows the angle bracket, then a space
+		// it is RFC5424, as RFC3164 must begin with a letter (month name)
+		if (angle+2 == i) && (data[angle+1] >= '0') && (data[angle+1] <= '9') {
+			return detectedRFC5424
+		} else {
+			return detectedRFC3164
+		}
+	}
+	// fallback to rfc 3164 section 4.3.3
+	return detectedRFC3164
+}
+
+func (f *Automatic) GetParser(line []byte) LogParser {
+	switch format := detect(line); format {
+	case detectedRFC3164:
+		return &parserWrapper{rfc3164.NewParser(line)}
+	case detectedRFC5424:
+		return &parserWrapper{rfc5424.NewParser(line)}
+	default:
+		// If the line was an RFC6587 line, the splitter should already have removed the length,
+		// so one of the above two will be chosen if the line is correctly formed. However, it
+		// may have a second length illegally placed at the start, in which case the detector
+		// will return detectedRFC6587. The line may also simply be malformed after the length in
+		// which case we will have detectedUnknown. In this case we return the simplest parser so
+		// the illegally formatted line is properly handled
+		return &parserWrapper{rfc3164.NewParser(line)}
+	}
+}
+
+func (f *Automatic) GetSplitFunc() bufio.SplitFunc {
+	return f.automaticScannerSplit
+}
+
+func (f *Automatic) automaticScannerSplit(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+
+	switch format := detect(data); format {
+	case detectedRFC6587:
+		return rfc6587ScannerSplit(data, atEOF)
+	case detectedRFC3164, detectedRFC5424:
+		// the default
+		return bufio.ScanLines(data, atEOF)
+	default:
+		if err != nil {
+			return 0, nil, err
+		}
+		// Request more data
+		return 0, nil, nil
+	}
+}

vendor/gopkg.in/mcuadros/go-syslog.v2/format/format.go

@@ -0,0 +1,29 @@
+package format
+
+import (
+	"bufio"
+	"time"
+
+	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser"
+)
+
+type LogParts map[string]interface{}
+
+type LogParser interface {
+	Parse() error
+	Dump() LogParts
+	Location(*time.Location)
+}
+
+type Format interface {
+	GetParser([]byte) LogParser
+	GetSplitFunc() bufio.SplitFunc
+}
+
+type parserWrapper struct {
+	syslogparser.LogParser
+}
+
+func (w *parserWrapper) Dump() LogParts {
+	return LogParts(w.LogParser.Dump())
+}

vendor/gopkg.in/mcuadros/go-syslog.v2/format/rfc3164.go

@@ -0,0 +1,17 @@
+package format
+
+import (
+	"bufio"
+
+	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser/rfc3164"
+)
+
+type RFC3164 struct{}
+
+func (f *RFC3164) GetParser(line []byte) LogParser {
+	return &parserWrapper{rfc3164.NewParser(line)}
+}
+
+func (f *RFC3164) GetSplitFunc() bufio.SplitFunc {
+	return nil
+}

vendor/gopkg.in/mcuadros/go-syslog.v2/format/rfc5424.go

@@ -0,0 +1,17 @@
+package format
+
+import (
+	"bufio"
+
+	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser/rfc5424"
+)
+
+type RFC5424 struct{}
+
+func (f *RFC5424) GetParser(line []byte) LogParser {
+	return &parserWrapper{rfc5424.NewParser(line)}
+}
+
+func (f *RFC5424) GetSplitFunc() bufio.SplitFunc {
+	return nil
+}

vendor/gopkg.in/mcuadros/go-syslog.v2/format/rfc6587.go

@@ -0,0 +1,45 @@
+package format
+
+import (
+	"bufio"
+	"bytes"
+	"strconv"
+
+	"gopkg.in/mcuadros/go-syslog.v2/internal/syslogparser/rfc5424"
+)
+
+type RFC6587 struct{}
+
+func (f *RFC6587) GetParser(line []byte) LogParser {
+	return &parserWrapper{rfc5424.NewParser(line)}
+}
+
+func (f *RFC6587) GetSplitFunc() bufio.SplitFunc {
+	return rfc6587ScannerSplit
+}
+
+func rfc6587ScannerSplit(data []byte, atEOF bool) (advance int, token []byte, err error) {
+	if atEOF && len(data) == 0 {
+		return 0, nil, nil
+	}
+
+	if i := bytes.IndexByte(data, ' '); i > 0 {
+		pLength := data[0:i]
+		length, err := strconv.Atoi(string(pLength))
+		if err != nil {
+			if string(data[0:1]) == "<" {
+				// Assume this frame uses non-transparent-framing
+				return len(data), data, nil
+			}
+			return 0, nil, err
+		}
+		end := length + i + 1
+		if len(data) >= end {
+			// Return the frame with the length removed
+			return end, data[i+1 : end], nil
+		}
+	}
+
+	// Request more data
+	return 0, nil, nil
+}