Artifact bca413df7884bb3569a4f05b0c3784c3d65955a9:

Attachment "_logs_store_logstash.php" to wiki page [log] added by mario 2015-01-10 16:13:08.

---

<?php
# type: partial


    // no need to compact subarrays or move extra entries into `context`
    var $literal_data = TRUE;


    // logstash tcp input
    var $logserver = ["udp://localhost", 7483, NULL, NULL, 2];
    var $logconn;


    /**
     * Logstash pushing
     * ‾‾‾‾‾‾‾‾
     * Similar to the JSON-Lines store, this output target just sends a blob with
     * notional hierarchy ids along.
     *
     * It requires a logstash setup using multiline+mutate filters to reconstruct
     * sequential event ids → using the "stream identity".
     *
     * Or you know, just keep the entries as-is. Keeping an event hierarchy is
     * useful, but not a dependency.  For low-traffic applications plain time-
     * ordering did the job okay enough since the 90s.
     *
     *
     * @param  array   log event data
     * @return int     event id
     */
    public function store($data) {

        // connection
        if (!isset($this->logconn)) {
            $this->logconn = call_user_func_array("pfsockopen", $this->logserver);
        }
    
        // local event id counter
        static $i = 0;
        $i++;
        
        // make parent references relative to primary group id
        $data["i"] = NULL;
        $data["g"] = NULL;
        if (isset($data["p"])) {
            if ($data["p"] != 0) {
                $data["p"] = $i - $data["p"] - 1;
            }
        }
        
        // send JSON blob
        fwrite($this->logconn, json_encode($data) . "\n");

        // return 
        return $i;
    }