- Introduction
- Deployment
- Configuration
- OS Support
- Integration
- Troubleshooting
- Enterprise Edition Reference Manual
- 127. Man Pages
- 128. Configuration
- 129. Language
- 130. Extension Modules
- 130.1. Remote Management (xm_admin)
- 130.2. AIX Auditing (xm_aixaudit)
- 130.3. Apple System Logs (xm_asl)
- 130.4. Basic Security Module Auditing (xm_bsm)
- 130.5. Common Event Format (xm_cef)
- 130.6. Character Set Conversion (xm_charconv)
- 130.7. Delimiter-Separated Values (xm_csv)
- 130.8. Encryption (xm_crypto)
- 130.9. External Programs (xm_exec)
- 130.10. File Lists (xm_filelist)
- 130.11. File Operations (xm_fileop)
- 130.12. GELF (xm_gelf)
- 130.13. Go (xm_go)
- 130.14. Grok (xm_grok)
- 130.15. Java (xm_java)
- 130.16. JSON (xm_json)
- 130.17. Key-Value Pairs (xm_kvp)
- 130.18. LEEF (xm_leef)
- 130.19. Microsoft DNS Server (xm_msdns)
- 130.20. Multiline Parser (xm_multiline)
- 130.21. NetFlow (xm_netflow)
- 130.22. Microsoft Network Policy Server (xm_nps)
- 130.23. Pattern Matcher (xm_pattern)
- 130.24. Perl (xm_perl)
- 130.25. Python (xm_python)
- 130.26. Resolver (xm_resolver)
- 130.27. Rewrite (xm_rewrite)
- 130.28. Ruby (xm_ruby)
- 130.29. SNMP Traps (xm_snmp)
- 130.30. Remote Management (xm_soapadmin)
- 130.31. Syslog (xm_syslog)
- 130.32. W3C (xm_w3c)
- 130.33. WTMP (xm_wtmp)
- 130.34. XML (xm_xml)
- 130.35. Compression (xm_zlib)
- 131. Input Modules
- 132. Processor Modules
- 133. Output Modules
- NXLog Manager
- NXLog Add-Ons
130.28. Ruby (xm_ruby)
This module provides support for processing NXLog log data with methods written in the Ruby language. Ruby methods can be defined in a script and then called from the Exec directive of any module that will use Ruby for log processing. See the example below. See also the im_ruby and om_ruby modules.
Note
|
To examine the supported platforms, see the list of installer packages in the Available Modules chapter. |
The Nxlog
module provides the following classes and methods.
- Nxlog.log_info(msg)
-
Send the message msg to the internal logger at DEBUG log level. This method does the same as the core log_debug() procedure.
- Nxlog.log_debug(msg)
-
Send the message msg to the internal logger at INFO log level. This method does the same as the core log_info() procedure.
- Nxlog.log_warning(msg)
-
Send the message msg to the internal logger at WARNING log level. This method does the same as the core log_warning() procedure.
- Nxlog.log_error(msg)
-
Send the message msg to the internal logger at ERROR log level. This method does the same as the core log_error() procedure.
- class Nxlog.LogData
-
This class represents an event.
- field_names()
-
This method returns an array with the names of all the fields currently in the event record.
- get_field(name)
-
This method returns the value of the field name in the event.
- set_field(name, value)
-
This method sets the value of field name to value.
130.28.1. Configuration
The xm_ruby module accepts the following directives in addition to the common module directives.
- RubyCode
-
This mandatory directive expects a file containing valid Ruby code. Methods defined in this file can be called with the ruby_call() procedure.
130.28.2. Procedures
The following procedures are exported by xm_ruby.
call(string subroutine);
-
Calls the Ruby method provided in the first argument.
ruby_call(string subroutine);
-
Calls the Ruby method provided in the first argument.
130.28.3. Examples
In this example logs are parsed as Syslog, then the data is passed to
a Ruby method which adds an incrementing $AlertCounter
field for any event
with a normalized $SeverityValue of at least
4.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension ruby>
Module xm_ruby
RubyCode ./modules/extension/ruby/processlogs2.rb
</Extension>
<Input in>
Module im_file
File 'test2.log'
<Exec>
parse_syslog();
ruby->call('add_alert_counter');
</Exec>
</Input>
$counter = 0
def add_alert_counter(event)
if event.get_field('SeverityValue') >= 4
Nxlog.log_debug('Adding AlertCounter field')
$counter += 1
event.set_field('AlertCounter', $counter)
end
end