Newbie question: Homer input format - what is mandatory (for AudioCodes log and other) #640

myrcinos · 2024-05-03T10:38:41Z

myrcinos
May 3, 2024

Hi,
This my first post and I hope it is in the right section.
I read everything I could and still can't find the answer.
I have installed Homer 7 in Docker and I have been trying to deliver logs from AudioCodes SBC to Homer via paStash. So far, I could configure paStash to receive logs from AudioCodes and do some basic Regex (based on what I found on the Internet). I can see that paStash is sending logs (confirmed using Wireshark) but they do not appear in Homer. I suspect, the format of the logs is incorrect and for that reason Homer does not display them. I know how to use regEx, Grok etc to manipulate the logs but my problem is that I don't know what Homer needs.
For example, when I use hepgen.js to test Homer installation, I can see that hepgen.js sends nicely formatted json logs, all fields have names etc. Do I need the same format with my logs or is there just a shorter list of mandatory mappings and the remaining data Homer will parse automatically? Any help would be appreciated.
P.S I also tried to find information on HEP format but with no luck.

lmangani · 2024-05-04T07:37:30Z

lmangani
May 4, 2024
Maintainer

Welcome to the community @myrcinos

Audiocodes logs are not smart and need lots of correlation hacks. Are you using the dedicated plugin or writing your own?

3 replies

myrcinos May 4, 2024
Author

I tired the Audiocodes plug-in but it wouldn’t work. The plug-in was throwing multiple errors and wouldn’t even start. I can also see that the plug-in is not regularly updated so I decided to do it on my own. I know the logs from Audiocodes are specific but that is fine as long as I understand what Homer needs.

lmangani May 4, 2024
Maintainer

We have users using the plugin in production - why not contributing to it instead? Everything here is user contributed.

Anyhow - you simply need to send a properly formatted object with both rcinfo and payload into the HEP output just like any of the existing SBC log plugins.

myrcinos May 4, 2024
Author

@lmangani I will probably try Audiocodes plugin again and in the same time I will work on my own. Then I will decide which option is better :) Thx!

myrcinos · 2024-05-13T10:25:15Z

myrcinos
May 13, 2024
Author

Hi, I decided to work on something easier. Instead of AudioCodes logs now I am trying to find a good config for Ribbon SBC logs. I don't know why but Ribbon SBC app did not work for me :(

So, here is my recipe:

input {
  udp {
    host => 0.0.0.0
    port => 514
    type => syslog
  }
}

filter {
 # app_sonus {}

 multiline {
    start_line_regex => /(^\<\d{3}\>\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}].*Received message on)|(^\<\d{3}\>\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}].*sending from)/

 max_delay => 8  
     regex_flags => i #ignor casing
    }
regex {
        regex => /Call-ID\:(.*)/
        fields => "correlation_id"
        }
regex {
        regex => /sending from \[(\S+)\]\:(\d+).*\[(\S+)\]\:(\d+)/
        fields => "srcIp,srcPort,dstIp,dstPort"
        }

regex {
        regex => /Received message on \[(\S+)\]\:(\d+).*\[(\S+)\]\:(\d+)/
        fields => "dstIp,dstPort,srcIp,srcPort"

        }

compute_field {
        field => 'payload'
        value => '#{message}'
        }

}

output {
  stdout{}
if [rcinfo] != 'undefined' {
        hep {
         host => '127.0.0.1'
        port => 9060
        hep_id => 2222
        hep_type => 1
        }
 }
}

This is what I get in Stdout{} (I replaced Public IP addresses and phone numbers with text string).

STDOUT] {
  "message": "<134>[2024-05-13 12:12:07,734] 4643 0006 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [SOURCE_IP]:59781\n<134>[2024-05-13 12:12:07,734] 4644 0005 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x2632c00:\n<134>[2024-05-13 12:12:07,734] 4645 0004 \n\nINVITE sip:+DIALED_NUMBER@HOST_IP;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP SOURCE_IP:59781;branch=z9hG4bK-524287-1---93d32140858ab73c\r\nMax-Forwards: 70\r\nContact: <sip:+CALLERs_NUMBER@SOURCE_IP:59781;transport=UDP>\r\nTo: <sip:+DIALED_NUMBER@HOST_IP;transport=UDP>\r\nFrom: \"+CALLERs_NUMBER\"<sip:+CALLERs_NUMBER@HOST_IP;transport=UDP>;tag=0564d23f\r\nCall-ID: Yznac-7S_-JB9CFVuQ6Xgg..\r\nCSeq: 1 INVITE\r\nContent-Type: application/sdp\r\nUser-Agent: Z 3.15.40006 rv2.8.20\r\nAllow-Events: presence, kpml, talk\r\nContent-Length: 241\r\n\r\nv=0\r\no=Z 0 0 IN IP4 SOURCE_IP\r\ns=Z\r\nc=IN IP4 SOURCE_IP\r\nt=0 0\r\nm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\na=rtpmap:110 speex/8000\r\na=rtpmap:97 iLBC/8000\r\na=fmtp:97 mode=30\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\n<134>[2024-05-13 12:12:07,734] 4646 0003 com.sonus.sbc.sip INFO (sipSignalingGroup.cpp:2333) - {SG(3) 0x1db9970} AddSession:AddSession Call ID: Yznac-7S_-JB9CFVuQ6Xgg.., Total = 0, sgid = 3",
  "host": "HOST_IP",
  "udp_port": "514",
  "type": "syslog",
  "@timestamp": "2024-05-13T10:12:07.750Z",
  "@version": "1",
  "correlation_id": " Yznac-7S_-JB9CFVuQ6Xgg..",
  "dstIp": "10.0.2.6",
  "dstPort": 5060,
  "srcIp": "SOURCE_IP",
  "srcPort": 59781,
  "payload": "<134>[2024-05-13 12:12:07,734] 4643 0006 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [SOURCE_IP]:59781\n<134>[2024-05-13 12:12:07,734] 4644 0005 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x2632c00:\n<134>[2024-05-13 12:12:07,734] 4645 0004 \n\nINVITE sip:+DIALED_NUMBER@HOST_IP;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP SOURCE_IP:59781;branch=z9hG4bK-524287-1---93d32140858ab73c\r\nMax-Forwards: 70\r\nContact: <sip:+CALLERs_NUMBER@SOURCE_IP:59781;transport=UDP>\r\nTo: <sip:+DIALED_NUMBER@HOST_IP;transport=UDP>\r\nFrom: \"+CALLERs_NUMBER\"<sip:+CALLERs_NUMBER@HOST_IP;transport=UDP>;tag=0564d23f\r\nCall-ID: Yznac-7S_-JB9CFVuQ6Xgg..\r\nCSeq: 1 INVITE\r\nContent-Type: application/sdp\r\nUser-Agent: Z 3.15.40006 rv2.8.20\r\nAllow-Events: presence, kpml, talk\r\nContent-Length: 241\r\n\r\nv=0\r\no=Z 0 0 IN IP4 SOURCE_IP\r\ns=Z\r\nc=IN IP4 SOURCE_IP\r\nt=0 0\r\nm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\na=rtpmap:110 speex/8000\r\na=rtpmap:97 iLBC/8000\r\na=fmtp:97 mode=30\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv\n<134>[2024-05-13 12:12:07,734] 4646 0003 com.sonus.sbc.sip INFO (sipSignalingGroup.cpp:2333) - {SG(3) 0x1db9970} AddSession:AddSession Call ID: Yznac-7S_-JB9CFVuQ6Xgg.., Total = 0, sgid = 3"
}

What am I doing wrong? I can't see anything in Homer.
I appreciate any guidance, thank you!

0 replies

myrcinos · 2024-05-20T09:02:16Z

myrcinos
May 20, 2024
Author

Hey @lmangani
I follow up our conversation on Element. Here is my recent config file for paStash:

input {
  udp {
    host => 0.0.0.0
    port => 514
    type => syslog
  }
}

filter {
 # app_sonus {}

 multiline {
    start_line_regex => /(^\<\d{3}\>\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}].*Received message on)|(^\<\d{3}\>\[\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}].*sending from)/
    max_delay => 8
    regex_flags => i #ignor casing
    }
regex {
        regex => /Call-ID\:(.*)/
        fields => "correlation_id"
        }
regex {
        regex => /sending from \[(\S+)\]\:(\d+).*\[(\S+)\]\:(\d+)/
        fields => "srcIp,srcPort,dstIp,dstPort"
        }

regex {
        regex => /Received message on \[(\S+)\]\:(\d+).*\[(\S+)\]\:(\d+)/
        fields => "dstIp,dstPort,srcIp,srcPort"
        }

compute_field {
        field => 'payload'
        value => '#{message}'
        }
#I am not sure about the below two compute_field.
compute_field {
        field => 'type'
        value => 'HEP'
}

compute_field {
        field => 'payload_type'
        value => '1'
}

}

output {
  stdout{}
  if [rcinfo] != 'undefined' {
        hep {
        host => '127.0.0.1'
        port => 9060
        hep_id => 2222
        }
 }
}

When I run paStash with this config, I get stdout{} similar to the below (I replaced some public IP addresses with placeholders):

[Mon, 20 May 2024 08:52:35 GMT] DEBUG Trying to match on regex /Received message on \[(\S+)\]\:(\d+).*\[(\S+)\]\:(\d+)/ , input <134>[2024-05-20 10:52:35,951] 7748 0003 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [PIP1_Client]:59439
<134>[2024-05-20 10:52:35,951] 7749 0002 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x1f57600:
<134>[2024-05-20 10:52:35,951] 7750 0001 

INVITE sip:+44123123123@PUBLICIP2_SBC;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 192.168.3.115:59439;branch=z9hG4bK-524287-1---9eb6d3b76d0573f5
Max-Forwards: 70
Contact: <sip:+48221230001@192.168.3.115:59439;transport=UDP>
To: <sip:+44123123123@PUBLICIP2_SBC;transport=UDP>
From: "+48221230001"<sip:+48221230001@PUBLICIP2_SBC;transport=UDP>;tag=5c3b1746
Call-ID: t4Oyz38QUWPJSiADnOfOVQ..
CSeq: 1 INVITE
Content-Type: application/sdp
User-Agent: Z 3.15.40006 rv2.8.20
Allow-Events: presence, kpml, talk
Content-Length: 241

v=0
o=Z 0 0 IN IP4 192.168.3.115
s=Z
c=IN IP4 192.168.3.115
t=0 0
m=audio 8000 RTP/AVP 3 110 8 0 97 101
a=rtpmap:110 speex/8000
a=rtpmap:97 iLBC/8000
a=fmtp:97 mode=30
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=sendrecv
[Mon, 20 May 2024 08:52:35 GMT] DEBUG Match result: [
  'Received message on [10.0.2.6]:5060 from [PIP1_Client]:59439',
  '10.0.2.6',
  '5060',
  'PIP1_Client',
  '59439',
  index: 107,
  input: '<134>[2024-05-20 10:52:35,951] 7748 0003 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [PIP1_Client]:59439\n' +
    '<134>[2024-05-20 10:52:35,951] 7749 0002 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x1f57600:\n' +
    '<134>[2024-05-20 10:52:35,951] 7750 0001 \n' +
    '\n' +
    'INVITE sip:+44123123123@PUBLICIP2_SBC;transport=UDP SIP/2.0\r\n' +
    'Via: SIP/2.0/UDP 192.168.3.115:59439;branch=z9hG4bK-524287-1---9eb6d3b76d0573f5\r\n' +
    'Max-Forwards: 70\r\n' +
    'Contact: <sip:+48221230001@192.168.3.115:59439;transport=UDP>\r\n' +
    'To: <sip:+44123123123@PUBLICIP2_SBC;transport=UDP>\r\n' +
    'From: "+48221230001"<sip:+48221230001@PUBLICIP2_SBC;transport=UDP>;tag=5c3b1746\r\n' +
    'Call-ID: t4Oyz38QUWPJSiADnOfOVQ..\r\n' +
    'CSeq: 1 INVITE\r\n' +
    'Content-Type: application/sdp\r\n' +
    'User-Agent: Z 3.15.40006 rv2.8.20\r\n' +
    'Allow-Events: presence, kpml, talk\r\n' +
    'Content-Length: 241\r\n' +
    '\r\n' +
    'v=0\r\n' +
    'o=Z 0 0 IN IP4 192.168.3.115\r\n' +
    's=Z\r\n' +
    'c=IN IP4 192.168.3.115\r\n' +
    't=0 0\r\n' +
    'm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\n' +
    'a=rtpmap:110 speex/8000\r\n' +
    'a=rtpmap:97 iLBC/8000\r\n' +
    'a=fmtp:97 mode=30\r\n' +
    'a=rtpmap:101 telephone-event/8000\r\n' +
    'a=fmtp:101 0-16\r\n' +
    'a=sendrecv',
  groups: undefined
]
[STDOUT] {
  "message": "<134>[2024-05-20 10:52:35,951] 7748 0003 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [PIP1_Client]:59439\n<134>[2024-05-20 10:52:35,951] 7749 0002 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x1f57600:\n<134>[2024-05-20 10:52:35,951] 7750 0001 \n\nINVITE sip:+44123123123@PUBLICIP2_SBC;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.3.115:59439;branch=z9hG4bK-524287-1---9eb6d3b76d0573f5\r\nMax-Forwards: 70\r\nContact: <sip:+48221230001@192.168.3.115:59439;transport=UDP>\r\nTo: <sip:+44123123123@PUBLICIP2_SBC;transport=UDP>\r\nFrom: \"+48221230001\"<sip:+48221230001@PUBLICIP2_SBC;transport=UDP>;tag=5c3b1746\r\nCall-ID: t4Oyz38QUWPJSiADnOfOVQ..\r\nCSeq: 1 INVITE\r\nContent-Type: application/sdp\r\nUser-Agent: Z 3.15.40006 rv2.8.20\r\nAllow-Events: presence, kpml, talk\r\nContent-Length: 241\r\n\r\nv=0\r\no=Z 0 0 IN IP4 192.168.3.115\r\ns=Z\r\nc=IN IP4 192.168.3.115\r\nt=0 0\r\nm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\na=rtpmap:110 speex/8000\r\na=rtpmap:97 iLBC/8000\r\na=fmtp:97 mode=30\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv",
  "host": "PUBLICIP2_SBC",
  "udp_port": "514",
  "type": "HEP",
  "@timestamp": "2024-05-20T08:52:35.963Z",
  "@version": "1",
  "correlation_id": " t4Oyz38QUWPJSiADnOfOVQ..",
  "dstIp": "10.0.2.6",
  "dstPort": 5060,
  "srcIp": "PIP1_Client",
  "srcPort": 59439,
  "payload": "<134>[2024-05-20 10:52:35,951] 7748 0003 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [PIP1_Client]:59439\n<134>[2024-05-20 10:52:35,951] 7749 0002 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x1f57600:\n<134>[2024-05-20 10:52:35,951] 7750 0001 \n\nINVITE sip:+44123123123@PUBLICIP2_SBC;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.3.115:59439;branch=z9hG4bK-524287-1---9eb6d3b76d0573f5\r\nMax-Forwards: 70\r\nContact: <sip:+48221230001@192.168.3.115:59439;transport=UDP>\r\nTo: <sip:+44123123123@PUBLICIP2_SBC;transport=UDP>\r\nFrom: \"+48221230001\"<sip:+48221230001@PUBLICIP2_SBC;transport=UDP>;tag=5c3b1746\r\nCall-ID: t4Oyz38QUWPJSiADnOfOVQ..\r\nCSeq: 1 INVITE\r\nContent-Type: application/sdp\r\nUser-Agent: Z 3.15.40006 rv2.8.20\r\nAllow-Events: presence, kpml, talk\r\nContent-Length: 241\r\n\r\nv=0\r\no=Z 0 0 IN IP4 192.168.3.115\r\ns=Z\r\nc=IN IP4 192.168.3.115\r\nt=0 0\r\nm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\na=rtpmap:110 speex/8000\r\na=rtpmap:97 iLBC/8000\r\na=fmtp:97 mode=30\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv",
  "payload_type": "1"
}

Unfortunately it is not showing in Homer 7. Can you help me?

0 replies

lmangani · 2024-05-20T11:13:43Z

lmangani
May 20, 2024
Maintainer

"payload": "<134>[2024-05-20 10:52:35,951] 7748 0003 com.sonus.sbc.sip INFO (sipApplication.cpp:1887) - tlDataReceived:Received message on [10.0.2.6]:5060 from [PIP1_Client]:59439\n<134>[2024-05-20 10:52:35,951] 7749 0002 com.sonus.sbc.sip INFO (SipMessage.cpp:1487) - origLen:778 decodedLength:778 decoded 0x1f57600:\n<134>[2024-05-20 10:52:35,951] 7750 0001 \n\nINVITE sip:+44123123123@PUBLICIP2_SBC;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.3.115:59439;branch=z9hG4bK-524287-1---9eb6d3b76d0573f5\r\nMax-Forwards: 70\r\nContact: sip:+48221230001@192.168.3.115:59439;transport=UDP\r\nTo: sip:+44123123123@PUBLICIP2_SBC;transport=UDP\r\nFrom: "+48221230001"sip:+48221230001@PUBLICIP2_SBC;transport=UDP;tag=5c3b1746\r\nCall-ID: t4Oyz38QUWPJSiADnOfOVQ..\r\nCSeq: 1 INVITE\r\nContent-Type: application/sdp\r\nUser-Agent: Z 3.15.40006 rv2.8.20\r\nAllow-Events: presence, kpml, talk\r\nContent-Length: 241\r\n\r\nv=0\r\no=Z 0 0 IN IP4 192.168.3.115\r\ns=Z\r\nc=IN IP4 192.168.3.115\r\nt=0 0\r\nm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\na=rtpmap:110 speex/8000\r\na=rtpmap:97 iLBC/8000\r\na=fmtp:97 mode=30\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv",

The payload needs to be a standard SIP message, not a log line. The rest seems generally OK

1 reply

myrcinos May 20, 2024
Author

Thanks for looking at this. However, this is what I get from Sonus. There are no options to change it on the Sonus SBC. Is there any other option to fix this? I wonder how other people got it working with their examples which are even simpler than mine.
Is there an option to format the payload in paStash? Thx!

lmangani · 2024-05-20T12:23:27Z

lmangani
May 20, 2024
Maintainer

That's exactly what our plugin does. It parses out the message AND the fields to form a proper payload and rcinfo set. You can transform the payload field with a further regex to only match from the beginning of the SIP message until the end, assuming all messages are integral which is often NOT the case with large SDP payloads where messages could get fragmented.

Using the plugin would make all these efforts unecessary so I'd suggest understanding why it didn't run and/or patching the plugin code if there are issues with it and the format you're receiving.

0 replies

myrcinos · 2024-05-20T12:28:33Z

myrcinos
May 20, 2024
Author

Point taken! Is there any debug/troubleshooting/log option that I could use to understand why the plugin didn't work in the first instance?

Would it work if my payload was like the below?

INVITE sip:+44123123123@PUBLICIP2_SBC;transport=UDP SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.3.115:59439;branch=z9hG4bK-524287-1---9eb6d3b76d0573f5\r\nMax-Forwards: 70\r\nContact: <sip:+48221230001@192.168.3.115:59439;transport=UDP>\r\nTo: <sip:+44123123123@PUBLICIP2_SBC;transport=UDP>\r\nFrom: \"+48221230001\"<sip:+48221230001@PUBLICIP2_SBC;transport=UDP>;tag=5c3b1746\r\nCall-ID: t4Oyz38QUWPJSiADnOfOVQ..\r\nCSeq: 1 INVITE\r\nContent-Type: application/sdp\r\nUser-Agent: Z 3.15.40006 rv2.8.20\r\nAllow-Events: presence, kpml, talk\r\nContent-Length: 241\r\n\r\nv=0\r\no=Z 0 0 IN IP4 192.168.3.115\r\ns=Z\r\nc=IN IP4 192.168.3.115\r\nt=0 0\r\nm=audio 8000 RTP/AVP 3 110 8 0 97 101\r\na=rtpmap:110 speex/8000\r\na=rtpmap:97 iLBC/8000\r\na=fmtp:97 mode=30\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101 0-16\r\na=sendrecv

0 replies

lmangani · 2024-05-20T12:36:48Z

lmangani
May 20, 2024
Maintainer

@myrcinos absolutely as long as all the newlines are preserved it should be parsed just fine. please show us the final output object to confirm

0 replies

myrcinos · 2024-05-23T14:26:39Z

myrcinos
May 23, 2024
Author

@lmangani Hey Lorenzo, could you point me Github link for the latest version of Sonus App plugin or a command how to install it properly? I can't find it, I am sure I had this bookmarked but now I can't find it :(

2 replies

lmangani May 23, 2024
Maintainer

all plugins are in the pastash git plugins folder and pushed individually to our npm namespace
most of them are documented in the wiki through the right menu

myrcinos May 23, 2024
Author

@lmangani are these RegEx here: https://github.com/sipcapture/paStash/blob/37bd2b5f6063ea4a5c6e4e1a819ded2fed211786/plugins/filters/app_sonus/filter_app_sonuslog.js#L77

Responsible for parsing the log and getting parameters? If so, the format of my log from Sonus SweLite is very different.

lmangani · 2024-05-23T15:40:50Z

lmangani
May 23, 2024
Maintainer

@myrcinos I don't own any such equipment so I guess it might change between them. my suggestion would be to fork and PR the changes for your SBC model and we can add a "type" switch to select the regex for the right model, etc as we do for other vendors

1 reply

myrcinos May 23, 2024
Author

@lmangani Cool. What do I need to do? What do you need from me to be able to modify the code? I am more than happy to help.

lmangani · 2024-05-23T15:46:26Z

lmangani
May 23, 2024
Maintainer

I won't be able to modify the code since I do not know the input or what the differences might be. So you'd have to fix the IN/OUT regexes to match your actual messages and once you have those rules sound fire in a PR or issue and we can do the rest easily together. Thanks!

1 reply

myrcinos May 23, 2024
Author

@lmangani As I said previously, I'm not a DEV guy but I'm familiar with Regex and Powershell scripting so I can try. However, could you point me some useful links that would help me debug? I need simple things such displaying on the screen what the filter app is processing at the moment etc. Would you be able to help?

lmangani · 2024-05-23T16:15:49Z

lmangani
May 23, 2024
Maintainer

@myrcinos no worries! the regex filters you see were developed with regex101 😄 all you need is a few good examples and some patience. I'll help with the rest.

5 replies

myrcinos May 24, 2024
Author

Hi, could you let me know if I should use app_sonus or app_sonuslog ?

myrcinos May 24, 2024
Author

@lmangani could you please advise?

myrcinos May 24, 2024
Author

So, I have done some testing and I found that when I use app_sonuslog it throws some errors about the modules, when I use app_sonus it does not. Also, I compared the code of both apps and it is the same.
However, I have multiple folders with each app. Probably because I was doing a lot of testing etc. Is there any way to say which exactly is being used when the app is running? I was able to identify most of them by adding a line logger.info('identification string'), but I coudlnt' find the one that is actually running smoothly as app_sonus :(

myrcinos May 24, 2024
Author

OK, so I think it needs to be app_sonuslog. When I run it I get Error but am I right that the module is finally found in @pastas/filter_app_sonuslog ?

[Fri, 24 May 2024 17:48:26 GMT] INFO Loading config : 7 urls
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Loading urls [
  'filter://add_host://',
  'filter://add_timestamp://',
  'filter://add_version://',
  'input://tcp://?host=0.0.0.0&port=514&type=syslog',
  'filter://app_sonuslog://',
  'output://stdout://',
  'output://hep://?host=127.0.0.1&port=9060&hep_id=2222&__dynamic_eval__=%7B%22false_clauses%22%3A%5B%5D%2C%22true_clause%22%3A%7B%22op%22%3A%22!%3D%22%2C%22left%22%3A%7B%22field%22%3A%22rcinfo%22%7D%2C%22right%22%3A%7B%22value%22%3A%22undefined%22%7D%7D%7D'
]
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module output
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing output Stdout
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module output
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing output HEP/EEP Server
[Fri, 24 May 2024 17:48:26 GMT] INFO Start output to HEP udp to 127.0.0.1:9060
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module filter
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing filter AddHost
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module filter
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing filter AddTimestamp
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module filter
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing filter AddVersion
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module filter
[Fri, 24 May 2024 17:48:26 GMT] DEBUG no local module found filters filter_app_sonuslog Error: Cannot find module 'filters/filter_app_sonuslog'
Require stack:
- /usr/local/lib/node_modules/@pastash/pastash/lib/agent.js
- /usr/local/lib/node_modules/@pastash/pastash/bin/pastash
    at Module._resolveFilename (node:internal/modules/cjs/loader:1039:15)
    at Module._load (node:internal/modules/cjs/loader:885:27)
    at Module.require (node:internal/modules/cjs/loader:1105:19)
    at require (node:internal/modules/cjs/helpers:103:18)
    at LogstashAgent.configure (/usr/local/lib/node_modules/@pastash/pastash/lib/agent.js:133:17)
    at LogstashAgent.<anonymous> (/usr/local/lib/node_modules/@pastash/pastash/lib/agent.js:215:10)
    at /usr/local/lib/node_modules/@pastash/pastash/node_modules/async/dist/async.js:3113:16
    at replenish (/usr/local/lib/node_modules/@pastash/pastash/node_modules/async/dist/async.js:1014:17)
    at /usr/local/lib/node_modules/@pastash/pastash/node_modules/async/dist/async.js:1019:9
    at eachLimit$1 (/usr/local/lib/node_modules/@pastash/pastash/node_modules/async/dist/async.js:3199:24) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    '/usr/local/lib/node_modules/@pastash/pastash/lib/agent.js',
    '/usr/local/lib/node_modules/@pastash/pastash/bin/pastash'
  ]
}
Loading npm module... @pastash/filter_app_sonuslog
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing filter AppSonusLog
[Fri, 24 May 2024 17:48:26 GMT] INFO Initialized App Sonus SysLog to SIP/HEP parser
[Fri, 24 May 2024 17:48:26 GMT] INFO /usr/local/lib/node_modules/@pastash/filter_app_sonuslog
[Fri, 24 May 2024 17:48:26 GMT] DEBUG Initializing module input
[Fri, 24 May 2024 17:48:26 GMT] INFO Initializing input Tcp
[Fri, 24 May 2024 17:48:26 GMT] INFO Start listening on tcp 0.0.0.0:514
[Fri, 24 May 2024 17:48:26 GMT] INFO Config loaded.

myrcinos May 29, 2024
Author

@lmangani should it produce any output to the screen?

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Newbie question: Homer input format - what is mandatory (for AudioCodes log and other) #640

{{title}}

Replies: 11 comments 13 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Newbie question: Homer input format - what is mandatory (for AudioCodes log and other) #640

myrcinos May 3, 2024

Replies: 11 comments · 13 replies

lmangani May 4, 2024 Maintainer

myrcinos May 4, 2024 Author

lmangani May 4, 2024 Maintainer

myrcinos May 4, 2024 Author

myrcinos May 13, 2024 Author

myrcinos May 20, 2024 Author

lmangani May 20, 2024 Maintainer

myrcinos May 20, 2024 Author

lmangani May 20, 2024 Maintainer

myrcinos May 20, 2024 Author

lmangani May 20, 2024 Maintainer

myrcinos May 23, 2024 Author

lmangani May 23, 2024 Maintainer

myrcinos May 23, 2024 Author

lmangani May 23, 2024 Maintainer

myrcinos May 23, 2024 Author

lmangani May 23, 2024 Maintainer

myrcinos May 23, 2024 Author

lmangani May 23, 2024 Maintainer

myrcinos May 24, 2024 Author

myrcinos May 24, 2024 Author

myrcinos May 24, 2024 Author

myrcinos May 24, 2024 Author

myrcinos May 29, 2024 Author

myrcinos
May 3, 2024

Replies: 11 comments 13 replies

lmangani
May 4, 2024
Maintainer

myrcinos May 4, 2024
Author

lmangani May 4, 2024
Maintainer

myrcinos May 4, 2024
Author

myrcinos
May 13, 2024
Author

myrcinos
May 20, 2024
Author

lmangani
May 20, 2024
Maintainer

myrcinos May 20, 2024
Author

lmangani
May 20, 2024
Maintainer

myrcinos
May 20, 2024
Author

lmangani
May 20, 2024
Maintainer

myrcinos
May 23, 2024
Author

lmangani May 23, 2024
Maintainer

myrcinos May 23, 2024
Author

lmangani
May 23, 2024
Maintainer

myrcinos May 23, 2024
Author

lmangani
May 23, 2024
Maintainer

myrcinos May 23, 2024
Author

lmangani
May 23, 2024
Maintainer

myrcinos May 24, 2024
Author

myrcinos May 24, 2024
Author

myrcinos May 24, 2024
Author

myrcinos May 24, 2024
Author

myrcinos May 29, 2024
Author