README.md 860 Bytes
Newer Older
Jordan Sissel's avatar
-  
Jordan Sissel committed
1
2
3
# lumberjack

Collect logs locally in preparation for processing elsewhere!
Jordan Sissel's avatar
Jordan Sissel committed
4
5
6
7
8

Problem: logstash jar releases are too fat for constrained systems.

Goal: Something small, fast, and light-weight to ship local logs externally.

Jordan Sissel's avatar
Jordan Sissel committed
9
## Requirements
Jordan Sissel's avatar
Jordan Sissel committed
10
11

* minimal resources
12
* configurable event data
Jordan Sissel's avatar
Jordan Sissel committed
13
14
15
16
17
18
19
20
21

Simple inputs only:

* follow files, respect rename/truncation conditions
* local sockets

Simple outputs only:

* custom wire event protocol (TBD)
22
23
24
25
26
27
28
29
30
31
32

## Tentative idea:

    # Ship apache logs in real time to somehost:12345
    ./lumberjack --target somehost:12345 /var/log/apache/access.log ...

    # Ship apache logs with additional log fields:
    ./lumberjack --target foo:12345 --field host=$HOSTNAME --field role=apt-repo /mnt/apt/access.log

Wire protocol will be msgpack for speed of parsing unless I find something
faster that's easy to use in as many languages.