eels_log_import(1Meels)

eels_log_import -- insert rows into an EELS database from a log import script

Synopsis

eels_log_import -o field_order [-d database_name] [-r record_delimiter]
[-f field_delimiter] [-t table_name] [-z trace_level]

eels_log_import -l

eels_log_import -L

Description

The eels_log_import command is used by log import scripts to insert records in the EELS database. Users with the appropriate database privileges can also import records into the EELS database using this command. eels_log_import works in two modes, in the first mode, records are imported directly into the database without passing through the EELS driver, the second mode, the records are passed through the driver for some basic processing. This basic processing includes the assignment of unique event Ids that are essential for maintaining the integrity of an EELS database. The direct mode of operation is available for some of the standard EELS commands such as eels_log_restore(1Meels). For more information see the -d option described below.

The input data stream for eels_log_import must consist of fields and records delimited by field and record delimiter characters; these delimiter characters are specified on the command line. If either of the delimiters appears in a field's text, the log import script (that produces the input stream) must escape them using the escape character ``\''. If the escape character itself appears in the field's text, is must also be escaped, by using a double escape (``\\'').

NOTE: The ``EELSUser'' configuration block must be defined in eels_config(4eels), and an RTLSP process must be running before you can use eels_log_import. For more information, see the ``Log sources'' in Enhanced Event Logging System topic.

This command also provides the -l and -L options that enable scripts to list the field names within the events table.

Options

-d database_name: Specify the destination database name where the data stream should be imported. Using this option bypasses the EELS driver and as such is discouraged. Under normal circumstances you should avoid using the -d option, in which case your records are first passed through the filter attached to the ``EELSUser'' log message source and then imported into the database and table specified by the associated data sink. For more information on filters and data sinks, see eels_config(4eels).
-f field_delimiter: The character the log import script uses to delimit fields in the input stream. The default is the UNIX pipe symbol ``|''.
-l: List all the field names (one per line) in the events table to standard output.
-L: List all the field names (separated by a space) in the events table to standard output.
-o field_order: A space separated list of field names that specify the order of the fields within the input stream generated by the log import script.
-r record_delimiter: The character the log import script uses to delimit records in the input stream. The default is the newline character ``\n''.
-t table_name: Specify a destination table name to import the data stream into. The table you specify must have been created previously using eels_db_admin(1Meels). The default table name is ``events''.
-z trace_level: Print debugging information. Valid debugging levels are ``1'' for minimal logging to ``4'' for full logging.

Examples

myscript /var/tmp/mylog | \
eels_log_import -o "ProcessID, LogSystemSource, \
TimeOffset, EventSpecificInformation"

This example shows a script myscript that reads records from a proprietary log file /var/tmp/mylog, and prints them to standard out in the order specified by the -o option. The fields are delimited by the default character ``|'' and the records by the default character ``\n''. Since no -d or -t options were specified, the records were passed to the ``EELSUser'' RTLSP process for filtering and logging. For example, if /etc/default/eels contained the following configuration blocks:

   real-time-import EELSUser {
   	EELSUser	default;
   	filter	EELSUser_filter;
   }
   log-destination default {
   	database	defaultdb;
   	table		events;
   }
   filter EELSUser_filter {
   	include "EventSpecificInformation ~ 'error'";
   	exclude "EventSpecificInformation == '*'";
   }

The records would first be filtered using the ``EELSUser_filter'' block (only include messages that contain the word ``error'' in the EventSpecificInformation field). Any records that pass through the filter will be imported into a database called defaultdb and a table called ``events''.

References

eels_db_admin(1Meels), eels_config(4eels)