logstash/logstash — pull request #127 by focaccio (2012-03-22 23:45:02+00:00)
Title: Updates for gelf outputs and event token replace

I needed to make some changes to get logstash working with graylog using gelf as both the input and output mechanism.

Based on the documentation for gelf, 'level' should be sent rather than 'severity' so I updated the token that gelf.rb is searching for (keeping severity in the array for backwards compatibility).

The biggest change here is that event.sprintf would now strip out any unreplaced tokens. This allows us to check the result for an empty string to move onto the next value in an array of possible tokens. If this isn't desired, this could be updated to check if the token still exists in the resulting string (but that could get complicated if more than one token should be replaced).

At one point, you removed the ability to have 'facility' be a part of the input for gelf. I put this back in but fixed how it was working (the token wasn't being found because it didn't search in the fields array).

I hope these updates are useful to you.