Database Reference
In-Depth Information
The Netcat source reads in newline-delimited text lines with, by default, a
maximum length of 512 bytes (not characters, which are of variable length).
To increase this limit, modify the
max-line-length
property:
agent_1.source.source-1.max-line-length=1024
To provide backpressure support, the Netcat source also positively
acknowledges that every event is received with an OK response. If needed,
you can disable this
acknowledgement
by setting the
ack-every-event
property to
false
:
agent_1.source.source-1.ack-every-event=false
Syslog Source
Syslogisastandardforsystemsloggingthatwasoriginallydevelopedaspart
oftheSendmailpackageinthe1980s.Ithassincegrownintoastandardthat
is governed—originally by RFC 3164 “The BSD Syslog Protocol” and now by
RFC 5424 “The Syslog Protocol.”
Flume supports RFC 3164 and much of RFC 5424 through three flavors of
Syslog source. The first is a single port TCP source called
syslogtcp
. Like
other TCP-based sources, it takes the usual bind address and port:
agent_1.source.source-1.type=syslogtcp
agent_1.source.source-1.bind=0.0.0.0
agent_1.source.source-1.port=5140
Themaximumsizeoftheeventsiscontrolledwiththe
eventSize
property,
which defaults to 2,500 bytes:
agent_1.source.source-1.eventSize=2500
Flume also supports a more modern multiport implementation of the TCP
Syslog source. To use it, change the
type
to
multiport_syslogtcp
and
use the
ports
property instead of the
port
property when configuring the
source:
agent_1.source.source-1.type=multiport_syslogtcp
agent_1.source.source-1.bind=0.0.0.0
agent_1.source.source-1.port=10001 10002 10003
