Ambud Sharma created FLUME-1938:
-----------------------------------
Summary: Flume UDP Source for Windows Events being trimmed at \n
characters by SyslogUtils.extractEvent() function
Key: FLUME-1938
URL: https://issues.apache.org/jira/browse/FLUME-1938
Project: Flume
Issue Type: Improvement
Components: Configuration, Sinks+Sources
Affects Versions: v1.3.1
Environment: Ubuntu/Linux
Reporter: Ambud Sharma
Fix For: v1.4.0
Flume trims UDP syslog events originating from Kiwi Windows Event Log Forwarder
at the first new-line character.
I would like to contribute with a patch to allow configurable inclusion of
new-line characters for SyslogUDP source in Flume
Background:
I am using Solarwinds/Kiwi Syslog's Windows Event Log Forwarder. Ref:
http://www.solarwinds.com/kiwi-syslog-server.aspx
The Log Forwarder sends CR+LF & horizontal tab characters in the UDP/TCP syslog
events that it sends. Other than Kiwi Syslog this problem exists for syslog-ng
on certain linux syslog events where CR+LF characters are sent in syslog
events.
Syslog-ng handles this problem by replacing these characters with \011 and
\015\012 but Flume has no such charset customization available for SyslogUDP.
SyslogTCP does have charset customization along with character replace
functionality for header.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
