指定Flume日志分类级别

用UDP或TCP接受syslog格式日志的时候，比如：

flume dump 'syslogUdp(5140)'

 这个命令使用UDP在5140端口接收日志。这时候假如你希望从命令行测试能否成功接收：

echo '<37>Hello from cmd.' |nc -u localhost 5140

 一定要在测试文本头加上<37>用来对日志进行分类，否则flume会抛出如下错误：

2013-07-16 08:26:49,614 [logicalNode dump-10] WARN syslog.SyslogUdpSource: 1 rejected packets. packet: java.net.DatagramPacket@51c888d9
com.cloudera.flume.handlers.text.EventExtractException: Failed to extract syslog wire entry
	at com.cloudera.flume.handlers.syslog.SyslogWireExtractor.extract(SyslogWireExtractor.java:178)
	at com.cloudera.flume.handlers.syslog.SyslogWireExtractor.extractEvent(SyslogWireExtractor.java:89)
	at com.cloudera.flume.handlers.syslog.SyslogUdpSource.next(SyslogUdpSource.java:88)
	at com.cloudera.flume.core.connector.DirectDriver$PumperThread.run(DirectDriver.java:108)

 

来自Cloudera的解释：The extra <37> is a syslog wireformat encoding of a message category and priority level.

 

用TCP来接收syslog的方法如下：

$ flume dump 'syslogTcp(5140)'

 这时候打开另一个命令行窗口，输入：

[cloudera@n4 ~]$ echo '<37>Hello from cmd.' |nc -t localhost 5140

 就可以在接收日志的窗口看到"Hello from cmd."输出，这里我们使用flume dump把接收到的日志打印在命令行。