feat: migrate configuration from custom format to YAML
- Replace custom directive-based config parser with YAML using gopkg.in/yaml.v3 - Rename config.example.conf to config.example.yml with YAML syntax - Update default config path to /etc/logcorrelator/logcorrelator.yml - Update Dockerfile.package to copy YAML config files - Update packaging scripts to install logcorrelator.yml - Update architecture.yml to document YAML configuration - Add yaml.v3 dependency to go.mod Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
This commit is contained in:
@ -21,11 +21,11 @@ runtime:
|
||||
unit_type: systemd
|
||||
description: >
|
||||
logcorrelator est livré sous forme de binaire autonome, exécuté comme un
|
||||
service systemd. L’unité systemd assure le démarrage automatique au boot,
|
||||
le redémarrage en cas de crash, et une intégration standard dans l’écosystème
|
||||
service systemd. L'unité systemd assure le démarrage automatique au boot,
|
||||
le redémarrage en cas de crash, et une intégration standard dans l'écosystème
|
||||
Linux (notamment sur Rocky Linux 8+).
|
||||
binary_path: /usr/bin/logcorrelator
|
||||
config_path: /etc/logcorrelator/logcorrelator.toml
|
||||
config_path: /etc/logcorrelator/logcorrelator.yml
|
||||
user: logcorrelator
|
||||
group: logcorrelator
|
||||
restart: on-failure
|
||||
@ -40,7 +40,7 @@ runtime:
|
||||
Type=simple
|
||||
User=logcorrelator
|
||||
Group=logcorrelator
|
||||
ExecStart=/usr/bin/logcorrelator -config /etc/logcorrelator/logcorrelator.toml
|
||||
ExecStart=/usr/bin/logcorrelator -config /etc/logcorrelator/logcorrelator.yml
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
@ -68,51 +68,53 @@ runtime:
|
||||
de drop), ferme les connexions ClickHouse puis s’arrête.
|
||||
|
||||
config:
|
||||
format: toml
|
||||
location: /etc/logcorrelator/logcorrelator.toml
|
||||
format: yaml
|
||||
location: /etc/logcorrelator/logcorrelator.yml
|
||||
description: >
|
||||
Toute la configuration est centralisée dans un fichier TOML lisible, stocké
|
||||
dans /etc/logcorrelator. Ni YAML ni JSON ne sont utilisés pour la config.
|
||||
Toute la configuration est centralisée dans un fichier YAML lisible,
|
||||
stocké dans /etc/logcorrelator.
|
||||
reload_strategy: restart_service
|
||||
example: |
|
||||
[service]
|
||||
name = "logcorrelator"
|
||||
language = "go"
|
||||
# Service configuration
|
||||
service:
|
||||
name: logcorrelator
|
||||
language: go
|
||||
|
||||
[[inputs.unix_sockets]]
|
||||
name = "apache_source"
|
||||
path = "/var/run/logcorrelator/apache.sock"
|
||||
format = "json"
|
||||
# Input sources (at least 2 required)
|
||||
inputs:
|
||||
unix_sockets:
|
||||
- name: apache_source
|
||||
path: /var/run/logcorrelator/apache.sock
|
||||
format: json
|
||||
- name: network_source
|
||||
path: /var/run/logcorrelator/network.sock
|
||||
format: json
|
||||
|
||||
[[inputs.unix_sockets]]
|
||||
name = "network_source"
|
||||
path = "/var/run/logcorrelator/network.sock"
|
||||
format = "json"
|
||||
# File output
|
||||
outputs:
|
||||
file:
|
||||
enabled: true
|
||||
path: /var/log/logcorrelator/correlated.log
|
||||
|
||||
[outputs.file]
|
||||
enabled = true
|
||||
path = "/var/log/logcorrelator/correlated.log"
|
||||
# ClickHouse output
|
||||
outputs:
|
||||
clickhouse:
|
||||
enabled: false
|
||||
dsn: clickhouse://user:pass@localhost:9000/db
|
||||
table: correlated_logs_http_network
|
||||
batch_size: 500
|
||||
|
||||
[outputs.clickhouse]
|
||||
enabled = true
|
||||
dsn = "clickhouse://user:pass@host:9000/db"
|
||||
table = "correlated_logs_http_network"
|
||||
batch_size = 500
|
||||
flush_interval_ms = 200
|
||||
max_buffer_size = 5000
|
||||
drop_on_overflow = true
|
||||
async_insert = true
|
||||
|
||||
[correlation]
|
||||
key = ["src_ip", "src_port"]
|
||||
|
||||
[correlation.time_window]
|
||||
value = 1
|
||||
unit = "s"
|
||||
|
||||
[correlation.orphan_policy]
|
||||
apache_always_emit = true
|
||||
network_emit = false
|
||||
# Correlation configuration
|
||||
correlation:
|
||||
key:
|
||||
- src_ip
|
||||
- src_port
|
||||
time_window:
|
||||
value: 1
|
||||
unit: s
|
||||
orphan_policy:
|
||||
apache_always_emit: true
|
||||
network_emit: false
|
||||
|
||||
inputs:
|
||||
description: >
|
||||
@ -503,12 +505,12 @@ packaging:
|
||||
dest: /usr/bin/logcorrelator
|
||||
mode: "0755"
|
||||
config:
|
||||
- source: config.example.conf
|
||||
dest: /etc/logcorrelator/logcorrelator.conf
|
||||
- source: config.example.yml
|
||||
dest: /etc/logcorrelator/logcorrelator.yml
|
||||
mode: "0640"
|
||||
config_file: true
|
||||
- source: config.example.conf
|
||||
dest: /usr/share/logcorrelator/logcorrelator.conf.example
|
||||
- source: config.example.yml
|
||||
dest: /usr/share/logcorrelator/logcorrelator.yml.example
|
||||
mode: "0640"
|
||||
directories:
|
||||
- path: /var/log/logcorrelator
|
||||
|
||||
Reference in New Issue
Block a user