Skip to content

Commit 2c631c0

Browse files
committed
docs: suggested changes 2
1 parent cfb3e4b commit 2c631c0

2 files changed

Lines changed: 15 additions & 3 deletions

File tree

docs/creating_parsers/index.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ This and subsequent sections describe how to create new parsers. SC4S parsers pe
99

1010
* Make sure you have read our [contribution standards](../CONTRIBUTING.md).
1111
* Obtain a raw log message that you want to parse. If you do not know how to do it, refer to [Obtain raw message events](../troubleshooting/troubleshoot_resources.md#obtain-raw-message-events).
12+
* Create a new branch in the repository where you will apply your changes.
1213
* Prepare your testing environment. With Python>=3.11.0:
1314

1415
```
@@ -20,7 +21,7 @@ poetry install
2021

2122
### Naming conventions and project structure
2223

23-
Parsers are .conf files with the naming convention: `app-type-vendor_product.conf`. Parsers that are part of the repository can be found at `package/etc/conf.d/conflib` or `package/lite/etc/addons` for Lite package. If you want to add locally new parser, you can add it to `/opt/sc4s/local` directory on your existing SC4S installation.
24+
Parsers are .conf files with the naming convention: `app-type-vendor_product.conf`. Parsers that are part of the repository can be found at `package/etc/conf.d/conflib` or `package/lite/etc/addons` for Lite package. Remember that adding your parser to the main or lite package in the repo requires building a new image for it to become available to your SC4S instance. If you want to add locally new parser, you can add it to `/opt/sc4s/local` directory on your existing SC4S installation.
2425

2526
### Parser structure
2627

@@ -38,4 +39,15 @@ The application filter will match all messages that start with the string `Carbo
3839

3940
![](../resources/images/parser_dev_basic_output.png)
4041

41-
To learn more about creating filters and parse blocks see pages: [Filter Messages](filter_message.md) and [Parse Messages](parse_message.md).
42+
To learn more about creating filters and parse blocks see pages: [Filter Messages](filter_message.md) and [Parse Messages](parse_message.md).
43+
44+
### Adding parser to SC4S Lite package
45+
46+
For SC4S lite, parsers are grouped into `addons`. Create a folder (if it doesn't already exist) in `package/lite/etc/addons` with the name of vendor. In this folder also create an `addon_metadata.yaml` file with vendor name:
47+
48+
```
49+
---
50+
name: "<vendor_name>"
51+
```
52+
53+
Lastly, add this addon to `package/lite/etc/config.yaml`.

docs/creating_parsers/parse_message.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ rewrite {
5252

5353
## Templates
5454

55-
The `template` parameter in `r_set_splunk_dest_default` controls what part of the message is forwarded to Splunk. Templates are defined in `package/etc/conf.d/conflib/_common/t_templates.conf`. The most common ones:
55+
The `template` parameter in `r_set_splunk_dest_default` controls what part of the message is forwarded to Splunk. Templates are defined in [`package/etc/conf.d/conflib/_common/t_templates.conf`](https://github.com/splunk/splunk-connect-for-syslog/blob/main/package/etc/conf.d/conflib/_common/t_templates.conf). The most common ones:
5656

5757
| Template | Content | Use case |
5858
|---|---|---|

0 commit comments

Comments
 (0)