将结构化的 json 日志注入 journald [英] Injecting structured json logs into journald
问题描述
我的印象是,可能有一种方法可以直接写入 systemd 日志、json 数据,而无需先将其转换为 sd_journal*
函数期望的格式.这可能吗?
I get the impression that there might be a way to write to the systemd journal, json data directly without first converting it to the format the sd_journal*
functions expect. Is this possible or not?
我的怀疑是因为一些关于内置 json 解析器的评论.然而,手册页另有说明.
My suspicion is because of some comments about an inbuilt json parser. However the man pages suggest otherwise.
另外,我注意到如果您以格式
Also, I note that if your write to stdout in the format
<priority> message
优先级将在 PRIORITY="priority" 字段中结束,消息将在 MESSAGE="message" 字段中结束.但是可以输入其他结构化的字段数据吗?
The priority will end up in the PRIORITY="priority" field and message will end up in MESSAGE="message" field. But can other structured field data be input?
注意:手册页没有讨论我提到的最后一个特性.因此,如果它们稍微过时,我不会感到惊讶,这就是我问的原因.
Note: The man pages do not talk about the last feature I mention. So I wouldn't be surprised if they are slightly out of date which is why I am asking.
推荐答案
journald 不接受任意的 JSON.只是键/值对.所以不可能发送嵌套的数据结构.您可以直接通过 Unix 域套接字发送数据:
journald doesn't accept arbitary JSON. Just Key/Value pairs. So it's not possible to send nested data structures. You can send data directly via the Unix Domain socket:
echo -e "MESSAGE=Hello\nFOO=BAR\nMY_ID=12345\n" |socat - UNIX-SENDTO:/run/systemd/journal/socket
结果:
{
"__CURSOR" : "s=46dc1bd66d0e4a48a6809e45228511e2;i=84cc;b=fd9144999d6846c8827d58f56c2635db;m=850161136;t=55669a307fdd6;x=887a021a37840789",
"__REALTIME_TIMESTAMP" : "1502386590318038",
"__MONOTONIC_TIMESTAMP" : "35703361846",
"_BOOT_ID" : "fd9144999d6846c8827d58f56c2635db",
"_TRANSPORT" : "journal",
"_UID" : "1001",
"_GID" : "1001",
"_CAP_EFFECTIVE" : "0",
"_SYSTEMD_OWNER_UID" : "1001",
"_SYSTEMD_SLICE" : "user-1001.slice",
"_SYSTEMD_USER_SLICE" : "-.slice",
"_MACHINE_ID" : "6e7b40640bf6473189165f19f8be2536",
"_HOSTNAME" : "samson",
"_SYSTEMD_UNIT" : "user@1001.service",
"_SYSTEMD_INVOCATION_ID" : "e5ed32fbb1004545b1ddf73a0d928d87",
"_SYSTEMD_CGROUP" : "/user.slice/user-1001.slice/user@1001.service/gnome-terminal-server.service",
"_SYSTEMD_USER_UNIT" : "gnome-terminal-server.service",
"_COMM" : "socat",
"_EXE" : "/usr/bin/socat",
"_CMDLINE" : "socat - UNIX-SENDTO:/run/systemd/journal/socket",
"FOO" : "BAR",
"MESSAGE" : "Hello",
"MY_ID" : "12345",
"_PID" : "19868",
"_SOURCE_REALTIME_TIMESTAMP" : "1502386590317991"
}
这篇关于将结构化的 json 日志注入 journald的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!