The purpose of input modules is to read data from a source and cut into into Orchids events, namely certain records of field\/value pairs.<\/p>\n
A typical example is the textfile<\/a> module, which reads data from a file, a pipe, or a Unix socket, and returns one event per text line; or the udp<\/a> module, which reads raw packets of data from a UDP connection; or the bintotext<\/a> module, which takes an Orchids event and converts its last field, which is a raw binary string, into sequences of text lines.<\/p>\n The fields declared by an input module must be at least two, and the last two play a special role:<\/p>\n Every input module also provides an <\/p>\n","protected":false},"excerpt":{"rendered":" The purpose of input modules is to read data from a source and cut into into Orchids events, namely certain records of field\/value pairs. A typical example is the textfile module, which reads data from a file, a pipe, or a Unix socket, and returns one event per text line; or the udp module, which … Continue reading Input modules<\/span> \n
.textfile.line<\/code>, and contains the last line read from the given file.<\/li>\n.textfile.file<\/code>; it contains the name of the file, pipe, or Unix socket from which the event was obtained, and depending on it, Orchids can be configured to parse lines coming from that source using the syslog<\/code> or the generic<\/code> module, say.<\/li>\n<\/ul>\nINPUT<\/code> configuration directive, so that one could in principle write, inside nn<\/em>_mod_textfile.conf<\/code>, one or several lines of the form `INPUT <\/code>file’<\/em>.\u00a0 That is frowned upon.\u00a0 Instead, you should write INPUT<\/code> directives in the orchids-inputs.conf<\/code><\/a> file. They have the slightly different syntax `INPUT <\/code>module-name<\/em> file’<\/em> there, and this is completely synonymous with writing `INPUT <\/code>file’<\/em> between `<module <\/code>module-name>'<\/code><\/em> and `<\/module>'<\/code>.\u00a0 The point is that the whole plumbing should be described in the single file orchids-inputs.conf<\/code><\/a>.<\/p>\n