diff --git a/lib/fluent/plugin/filter_parse_audit_log.rb b/lib/fluent/plugin/filter_parse_audit_log.rb index 95d8ca6..bed78ad 100644 --- a/lib/fluent/plugin/filter_parse_audit_log.rb +++ b/lib/fluent/plugin/filter_parse_audit_log.rb @@ -6,11 +6,14 @@ class FluentParseAuditLogFilter < Fluent::Filter config_param :key, :string, default: 'message' config_param :flatten, :bool, default: false + config_param :unhex, :bool, default: false + config_param :unhex_keys, :array, default: ['*'], value_type: :string + config_param :unhex_min_length, :integer, default: 8 def filter(tag, time, record) line = record[@key] return record unless line - AuditLogParser.parse_line(line, flatten: @flatten) + AuditLogParser.parse_line(line, flatten: @flatten, unhex: @unhex, unhex_keys: @unhex_keys, unhex_min_length: @unhex_min_length) rescue => e log.warn "failed to parse a audit log: #{line}", error_class: e.class, error: e.message log.warn_backtrace