格式化Apache Flume HDFS序列化程序
我刚刚开始使用flume,需要在hdfs接收器中插入一些标头 我有这个工作,虽然格式是错误的,我不能控制列 使用此配置:格式化Apache Flume HDFS序列化程序,apache,hadoop,flume,flume-ng,Apache,Hadoop,Flume,Flume Ng,我刚刚开始使用flume,需要在hdfs接收器中插入一些标头 我有这个工作,虽然格式是错误的,我不能控制列 使用此配置: a1.sources = r1 a1.sinks = k1 a1.channels = c1 a1.sources.r1.type = syslogudp a1.sources.r1.host = 0.0.0.0 a1.sources.r1.port = 44444 a1.sources.r1.interceptors = i1 i2 a1.sources.r1.inte
a1.sources = r1
a1.sinks = k1
a1.channels = c1
a1.sources.r1.type = syslogudp
a1.sources.r1.host = 0.0.0.0
a1.sources.r1.port = 44444
a1.sources.r1.interceptors = i1 i2
a1.sources.r1.interceptors.i1.type = org.apache.flume.interceptor.HostInterceptor$Builder
a1.sources.r1.interceptors.i1.preserveExisting = false
a1.sources.r1.interceptors.i1.hostHeader = hostname
a1.sources.r1.interceptors.i2.type = org.apache.flume.interceptor.TimestampInterceptor$Builder
a1.sources.r1.interceptors.i2.preserveExisting = false
a1.sinks.k1.type = hdfs
a1.sinks.k1.hdfs.path = hdfs://localhost:9000/user/vagrant/syslog/%y-%m-%d/
a1.sinks.k1.hdfs.rollInterval = 120
a1.sinks.k1.hdfs.rollCount = 100
a1.sinks.k1.hdfs.rollSize = 0
a1.sinks.k1.hdfs.fileType = DataStream
a1.sinks.k1.hdfs.writeFormat = Text
a1.sinks.k1.serializer = header_and_text
a1.sinks.k1.serializer.columns = timestamp hostname
a1.sinks.k1.serializer.format = CSV
a1.sinks.k1.serializer.appendNewline = true
a1.channels.c1.type = memory
a1.channels.c1.capacity = 1000
a1.channels.c1.transactionCapacity = 100
a1.sources.r1.channels = c1
a1.sinks.k1.channel = c1
除了序列化方面之外,写入HDFS的日志基本正常:
{timestamp=1415574695138, Severity=6, host=PolkaSpots, Facility=3, hostname=127.0.1.1} hostapd: wlan0-1: STA xx WPA: group key handshake completed (RSN)
如何格式化日志,使其看起来像这样:
1415574695138 127.0.1.1 hostapd: wlan0-1: STA xx WPA: group key handshake completed (RSN)
时间戳,首先是主机名,然后是syslog msg body。原因是您配置的两个拦截器正在将值写入Flume事件头中,这些头被HeaderAndBytextEventSerializer序列化到body中。后者就是这样做的:
public void write(Event e) throws IOException {
out.write((e.getHeaders() + " ").getBytes());
out.write(e.getBody());
if (appendNewline) {
out.write('\n');
}
}
委托给e.getHeaders()只会将映射序列化为JSON字符串
为了解决这个问题,我建议您创建自己的序列化程序,并重载write()方法,将输出格式化为制表符分隔的值。
在这种情况下,您只需要在以下位置指定类的路径:
a1.sinks.k1.serializer = com.mycompany.MySerlizer
然后把罐子放在Flume的类路径中。谢谢你的回复,我已经放弃了期待。我们暂时没有注意到这一点,但很快会尝试查看您的解决方案。非常感谢。