Parse the Heroku application/logplex documents sent over HTTPS log drains and their syslog contents
Heroku’s Logplex can be configured to send batches
of logs over HTTPS.
The application/logplex-1 documents use the framing scheme specified in RFC6587.
Each frame contains a syslog entry as specified in RFC5424 although Heroku forgoes encoding the structured-data nilvalue and skips straight to the message data ¯\(°_o)/¯
This module contains a parser for each format and decodes them into a LogEntry for consumption by
applications.
parseLogplex "106 <10>123 2015-12-03T23:12:17+11:00 keiths-macbook-pro.local logplex-parse 420 - [foo bar=\"baz\"] error=1234595 <10>123 2015-12-03T23:12:17+11:00 keiths-macbook-pro.local logplex-parse 420 - Error R99 heroku95 <10>123 2015-12-03T23:12:17+11:00 keiths-macbook-pro.local logplex-parse 420 - Error R89 heroku95 <10>123 2015-12-03T23:12:17+11:00 keiths-macbook-pro.local logplex-parse 420 - Error L99 heroku120 <10>123 2015-12-03T23:12:17+11:00 keiths-macbook-pro.local logplex-parse 420 - at=error code=H12 desc=\"a thing happened\""
Right [
LogEntry {getPriority = "10", getVersion = "123", getTimestamp = 2015-12-03 12:12:17 UTC, getHostname = "keiths-macbook-pro.local", getAppname = "logplex-parse", getProcessId = "420", getMessageId = "-", getStructuredData = [StructuredData {getId = "foo", getParams = [("bar","baz")]}], getMessage = Just "error=12345"},
LogEntry {getPriority = "10", getVersion = "123", getTimestamp = 2015-12-03 12:12:17 UTC, getHostname = "keiths-macbook-pro.local", getAppname = "logplex-parse", getProcessId = "420", getMessageId = "-", getStructuredData = [], getMessage = Just "Error R99 heroku"},
LogEntry {getPriority = "10", getVersion = "123", getTimestamp = 2015-12-03 12:12:17 UTC, getHostname = "keiths-macbook-pro.local", getAppname = "logplex-parse", getProcessId = "420", getMessageId = "-", getStructuredData = [], getMessage = Just "Error R89 heroku"},
LogEntry {getPriority = "10", getVersion = "123", getTimestamp = 2015-12-03 12:12:17 UTC, getHostname = "keiths-macbook-pro.local", getAppname = "logplex-parse", getProcessId = "420", getMessageId = "-", getStructuredData = [], getMessage = Just "Error L99 heroku"},
LogEntry {getPriority = "10", getVersion = "123", getTimestamp = 2015-12-03 12:12:17 UTC, getHostname = "keiths-macbook-pro.local", getAppname = "logplex-parse", getProcessId = "420", getMessageId = "-", getStructuredData = [], getMessage = Just "at=error code=H12 desc=\"a thing happened\""}
]