ops/logs
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
zxr
2026-04-11 20:03:42 +08:00
parent c152a9e573
commit 01c807b953
2 changed files with 25 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
doc/log-mgmt-frontend-design.md → doc/日志监控.md
View File

34
internal/ingest/engine.go
View File

@@ -129,12 +129,18 @@ func (e *Engine) HandleSyslog(addr *net.UDPAddr, payload []byte) {
if matched == nil { if matched == nil {
return return
} }
// 与 alert/doc/17-resource-correlation 约定一致（字段映射）
labels := map[string]string{ labels := map[string]string{
"source": "syslog", "source_type": "log",
"device": device, "source_subtype": "syslog",
"rule_id": strconv.FormatUint(uint64(matched.ID), 10), "resource_type": "log_rule",
"rule_name": matched.Name, "resource_id": strconv.FormatUint(uint64(matched.ID), 10),
"remote_addr": addr.String(), "rule_name": matched.Name,
"device": device,
"remote_addr": addr.String(),
"ip": addr.IP.String(),
"instance": firstNonEmpty(device, addr.String()),
"job": "logs-syslog",
} }
rawObj := map[string]interface{}{ rawObj := map[string]interface{}{
"source": "syslog", "source": "syslog",
@@ -302,13 +308,23 @@ func (e *Engine) HandleTrap(addr *net.UDPAddr, pkt *gosnmp.SnmpPacket) {
desc = readable + "\n恢复建议: " + dict.RecoveryMessage desc = readable + "\n恢复建议: " + dict.RecoveryMessage
} }
labels := map[string]string{ labels := map[string]string{
"source": "snmp_trap", "source_type": "log",
"trap_oid": trapOID, "source_subtype": "snmp_trap",
"remote_addr": addr.String(), "trap_oid": trapOID,
"remote_addr": addr.String(),
"ip": addr.IP.String(),
"instance": addr.IP.String(),
"job": "logs-trap",
} }
if matched.ID != 0 { if matched.ID != 0 {
labels["rule_id"] = strconv.FormatUint(uint64(matched.ID), 10) labels["resource_type"] = "trap_rule"
labels["resource_id"] = strconv.FormatUint(uint64(matched.ID), 10)
labels["rule_name"] = matched.Name labels["rule_name"] = matched.Name
} else {
labels["resource_type"] = "trap_dictionary"
if trapOID != "" {
labels["resource_id"] = trapOID
}
} }
resolved := map[string]interface{}{} resolved := map[string]interface{}{}
if dict != nil { if dict != nil {