Example Usage

There are two ways to use gelfd currently:

Running bin/gelfd

There's a small "demo" server installed with the gem called, amazingly, gelfd.

The way I feed data to this running logstash with the following config:

input { stdin { debug => true type => 'stdin'}}
output {
	stdout { debug => true}
	# Test chunked messages
	gelf { chunksize => 4 host => '127.0.0.1' port => 11211 }
	# Test unchunked messages
	gelf { host => '127.0.0.1' port => 11211 }
}

If you leave BOTH gelf outputs uncommented, you'll see duplicate messages in the gelfd output. Comment one out to see a single message

Sample output

• logstash agent (reads from stdin)

	java -jar logstash-1.0.17-monolithic.jar agent -c logstash.conf 
	foobar
	{
	         "@source" => "stdin://jvx64/",
	           "@type" => "stdin",
	           "@tags" => [],
	         "@fields" => {},
	      "@timestamp" => "2011-09-09T03:31:34.952000Z",
	    "@source_host" => "jvx64",
	    "@source_path" => "/",
	        "@message" => "foobar"
	}

• The gelfd server

	Starting up
	{"version":"1.0","host":"jvx64","level":null,"facility":"logstash-gelf","short_message":"foobar","full_message":"foobar","file":"/","timestamp":1315539095.041,"line":105}
	{"version":"1.0","host":"jvx64","level":null,"facility":"logstash-gelf","short_message":"foobar","full_message":"foobar","file":"/","timestamp":1315539095.041,"line":105}

You can see there's not much to it

Using in your own code

This is really simple as well:

	require 'zlib'
	require 'digest'
	require 'pp'
	require 'gelfd'
	
	last_chunk_id = 0
	max_chunk_size = 4
	
	json = '{"version":"1.0","host":"somehost","level":"debug","facility":"myapp","short_message":"boom","full_message":"something failed horribly","file":"myapp.rb","timestamp":1315539095.041,"line":105}'
	zjson = Zlib::Deflate::deflate(json).bytes
	
	# this just mimics the same thing that gelf-rb does when it logs
	data = zjson
	datagrams = []
	if data.count > max_chunk_size
	  id = last_chunk_id += 1
	  msg_id = Digest::MD5.digest("#{Time.now.to_f}-#{id}")[0, 8]
	  num, count = 0, (data.count.to_f / max_chunk_size).ceil
	  data.each_slice(max_chunk_size) do |slice|
	    datagrams << "\x1e\x0f" + msg_id + [num, count, *slice].pack('C*')
	    num += 1
	  end
	else
	  datagrams << data.to_a.pack('C*')
	end
	
	# Normally gelf-rb sends these over udp
	# we're just sending them to our parser
	datagrams.each do |gram|
	  @t = Gelfd::Parser.parse(gram)
	end
	
	# This should be the same as the original json
	puts @t unless @t.nil?

It's worth remembering that the original intention of this library is to provide the framework for a logstash GELF input. However the demo server binscript provides a great way to test your logstash gelf configuration before sending to graylog2 for real.