logsearch/logsearch-filters-cf — pull request #6 by dpb587 (2014-06-05 16:59:28+00:00)
Title: Separate vcap and loggregator parsers

This updates/adds parsers (based on the logsearch-filters-common/syslog parser) for vcap and loggregator messages. The vcap one pre-existed, but has been renamed and I've restructured it to match previous functionality (tests remained unchanged, aside from changing the grok-failure tag name).

This also updates and creates a dependency on the `vendor/logsearch-filters-common` submodule in order to include the syslog parser.

All this is functional, but I think we need to revisit a few things (but I don't want it to unnecessarily block or scope creep this particular PR)...

* how to properly package the dependency on syslog (or do we just say "you need to include logsearch-filters-common to use this")
* a better protocol or philosophy on how parsers build off each other (i.e. the sample loggregator messages seem like there should be three tiers: syslog, loggregator, app-specific parser (e.g. watcher-bot-ppe))
* along with that point, seems like some of our loggregator messages include a `@timestamp` (unnecessarily) which requires a date conversion... but that's very app specific and probably shouldn't be in this parser
* some of the vcap naming seems really odd, but I'm not sure if that's just because I don't understand CF stuff, or if there's actually a better structure