Events-processing output: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
Line 5: Line 5:
=Overview=
=Overview=


The default procedure to handle event streams: the procedure inspects the events and sends their string representation to the configured output stream.
The default procedure applied to event streams, in absence of any other configuration. The procedure inspects the events and sends their string representation to the configured output stream, usually stdout. The procedure can be programmatically configured with a different output stream.


The procedure can be configured with an output format.  
The procedure can be also configured with a custom output format. One way to provide the format specification is on command-line: format specification arguments follow the "-o" marker and end either with the last argument or when a higher level argument (file, for example) is encountered.The output format also acts as a filter - if the event does not match at least one of the output format elements, it will not be displayed at all.
 
One way to provide the format specification is on command-line: format specification arguments follow the "-o" marker and end either with the last argument or when a higher level argument (file, for example) is encountered.


  some-parser [output] -o <''output-format''> ./file.txt
  some-parser [output] -o <''output-format''> ./file.txt
Line 15: Line 13:
  cat ./file.txt | some-parser [output] -o <''output-format''>
  cat ./file.txt | some-parser [output] -o <''output-format''>


If no output format is specified, the output procedure will inspect the event, and will try to use, in order: the preferred representation, as returned by the event (if any), the raw representation, as returned by event (if any) and then a simple representation consisting in the event's timestamp, if available, and then the event's toString() invocation result.
If no output format is specified, the output procedure will inspect the event, and will try to use, in order, the preferred representation of the event, as returned by the event itself (if any), the raw representation of the event, as returned by event (if any) and then a simple representation consisting in the event's timestamp, if available, and then the event's toString() invocation result. If an output format is specified, the representation will contain a leading timestamp, if the event is a timed event, whether the timestamp property name is specified in the format or not. If it is specified, it will be redundantly displayed.


If an output format is specified, the representation will aways start with the timestamp, if the event is a timed event, whether the timestamp property name is specified in the format or not. If it is specified, it will be redundantly displayed.
=Headers=


=Output Format=
=Output Format=

Revision as of 18:27, 4 August 2017

Internal

Overview

The default procedure applied to event streams, in absence of any other configuration. The procedure inspects the events and sends their string representation to the configured output stream, usually stdout. The procedure can be programmatically configured with a different output stream.

The procedure can be also configured with a custom output format. One way to provide the format specification is on command-line: format specification arguments follow the "-o" marker and end either with the last argument or when a higher level argument (file, for example) is encountered.The output format also acts as a filter - if the event does not match at least one of the output format elements, it will not be displayed at all.

some-parser [output] -o <output-format> ./file.txt
cat ./file.txt | some-parser [output] -o <output-format>

If no output format is specified, the output procedure will inspect the event, and will try to use, in order, the preferred representation of the event, as returned by the event itself (if any), the raw representation of the event, as returned by event (if any) and then a simple representation consisting in the event's timestamp, if available, and then the event's toString() invocation result. If an output format is specified, the representation will contain a leading timestamp, if the event is a timed event, whether the timestamp property name is specified in the format or not. If it is specified, it will be redundantly displayed.

Headers

Output Format

The output format can be used to:

Displaying Specific Event Properties

Displaying Specific Event Types

Output Separator