You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/creating_parsers/index.md
+14-2Lines changed: 14 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,6 +9,7 @@ This and subsequent sections describe how to create new parsers. SC4S parsers pe
9
9
10
10
* Make sure you have read our [contribution standards](../CONTRIBUTING.md).
11
11
* Obtain a raw log message that you want to parse. If you do not know how to do it, refer to [Obtain raw message events](../troubleshooting/troubleshoot_resources.md#obtain-raw-message-events).
12
+
* Create a new branch in the repository where you will apply your changes.
12
13
* Prepare your testing environment. With Python>=3.11.0:
13
14
14
15
```
@@ -20,7 +21,7 @@ poetry install
20
21
21
22
### Naming conventions and project structure
22
23
23
-
Parsers are .conf files with the naming convention: `app-type-vendor_product.conf`. Parsers that are part of the repository can be found at `package/etc/conf.d/conflib` or `package/lite/etc/addons` for Lite package. If you want to add locally new parser, you can add it to `/opt/sc4s/local` directory on your existing SC4S installation.
24
+
Parsers are .conf files with the naming convention: `app-type-vendor_product.conf`. Parsers that are part of the repository can be found at `package/etc/conf.d/conflib` or `package/lite/etc/addons` for Lite package. Remember that adding your parser to the main or lite package in the repo requires building a new image for it to become available to your SC4S instance. If you want to add locally new parser, you can add it to `/opt/sc4s/local` directory on your existing SC4S installation.
24
25
25
26
### Parser structure
26
27
@@ -38,4 +39,15 @@ The application filter will match all messages that start with the string `Carbo
To learn more about creating filters and parse blocks see pages: [Filter Messages](filter_message.md) and [Parse Messages](parse_message.md).
42
+
To learn more about creating filters and parse blocks see pages: [Filter Messages](filter_message.md) and [Parse Messages](parse_message.md).
43
+
44
+
### Adding parser to SC4S Lite package
45
+
46
+
For SC4S lite, parsers are grouped into `addons`. Create a folder (if it doesn't already exist) in `package/lite/etc/addons` with the name of vendor. In this folder also create an `addon_metadata.yaml` file with vendor name:
47
+
48
+
```
49
+
---
50
+
name: "<vendor_name>"
51
+
```
52
+
53
+
Lastly, add this addon to `package/lite/etc/config.yaml`.
Copy file name to clipboardExpand all lines: docs/creating_parsers/parse_message.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ rewrite {
52
52
53
53
## Templates
54
54
55
-
The `template` parameter in `r_set_splunk_dest_default` controls what part of the message is forwarded to Splunk. Templates are defined in `package/etc/conf.d/conflib/_common/t_templates.conf`. The most common ones:
55
+
The `template` parameter in `r_set_splunk_dest_default` controls what part of the message is forwarded to Splunk. Templates are defined in [`package/etc/conf.d/conflib/_common/t_templates.conf`](https://github.com/splunk/splunk-connect-for-syslog/blob/main/package/etc/conf.d/conflib/_common/t_templates.conf). The most common ones:
0 commit comments