TCP Server

Supported pipeline types:
  • Data Collector

The TCP Server origin listens at the specified port numbers, establishes TCP sessions with clients that initiate TCP connections, and then processes the incoming data.

The origin can operate in different modes. The modes determine the messages that it can process. It can process NetFlow messages or syslog messages. It can also process supported Data Collector data formats passed as data separated by specified characters, passed as character-based data with length prefixes, or passed in Flume events as Avro messages.

The TCP Server can process data from multiple clients simultaneously, creating separate batches for each client, and sending acknowledgements to the originating client after parsing each record or committing each batch. You can configure the origin to use multiple threads to improve performance when processing of large volumes of data. And on 64-bit Linux systems, you can enable native Epoll transports to further improve performance.

When you configure the TCP Server origin, you specify the ports to use and the TCP mode that indicates the type of data the origin will receive. Then you configure mode-related properties, such as the characters that separate records.

You can optionally configure the acknowledgements that you want to send and the amount of time that the origin waits to receive data before closing the connection. You can also configure SSL/TLS properties, including default transport protocols and cipher suites.

Multithreaded Processing

The TCP Server origin performs parallel processing and enables the creation of a multithreaded pipeline.

When you enable multithreaded processing, the TCP Server origin uses multiple concurrent threads based on the Number of Receiver Threads property. When you start the pipeline, the origin creates the number of threads specified in the property.

As clients initiate TCP connections, the origin establishes TCP sessions and waits for data. Upon filling a batch, the origin passes the batch to an available pipeline runner.

A pipeline runner is a sourceless pipeline instance - an instance of the pipeline that includes all of the processors and destinations in the pipeline and represents all pipeline processing after the origin. Each pipeline runner processes one batch at a time, just like a pipeline that runs on a single thread. When the flow of data slows, the pipeline runners wait idly until they are needed, generating an empty batch at regular intervals. You can configure the Runner Idle Time pipeline property to specify the interval or to opt out of empty batch generation.

Multithreaded pipelines preserve the order of records within each batch, just like a single-threaded pipeline. But since batches are processed by different pipeline runners, the order that batches are written to destinations is not ensured.

For example, say you enable multithreaded processing and set the Number of Receiver Threads property to 5. When you start the pipeline, the origin creates five threads, and Data Collector creates a matching number of pipeline runners. Upon receiving data, the origin passes a batch to each of the pipeline runners for processing.

Each pipeline runner performs the processing associated with the rest of the pipeline. After a batch is written to pipeline destinations, the pipeline runner becomes available for another batch of data. Each batch is processed and written as quickly as possible, independent from other batches processed by other pipeline runners, so batches may be written differently from the read-order.

At any given moment, the five pipeline runners can each process a batch, so this multithreaded pipeline processes up to five batches at a time. When incoming data slows, the pipeline runners sit idle, available for use as soon as the data flow increases.

For more information about multithreaded pipelines, see Multithreaded Pipeline Overview.

Closing Connections for Invalid Data

When the TCP Server origin receives invalid data, it closes the connection to the TCP client that sent the data. It also passes the data to the pipeline for error handling.

For example, when you configure the origin, you specify the maximum record size. When a TCP client sends a message that translates to larger than the maximum record size, the origin disconnects from the client and passes the message to the pipeline for error handling.

Similarly, say the TCP Server origin is configured to process XML data. If the origin receives an invalid XML document, it disconnects from the sending client and passes the data to the pipeline for error handling.

Sending Acknowledgements

You can configure the TCP Server origin to send acknowlegements, a.k.a. acks., to the originating client. The acknowledgement message can be a simple text message, such as "Ack". Or, you can use the expression language to include additional information in the message.

The origin can send two types of acknowledgements:
record processed acknowledgement
When you configure a record processed acknowledgement, the origin sends acks after it receives and processes each record. It sends the ack after parsing a record from the incoming data.
batch completed acknowledgement
When you configure a batch completed acknowledgement, the origin sends acks after the pipeline completes processing the batch. It sends the ack after the batch is committed to all destinations.

Using Expressions in Messages

You can use the Data Collector expression language to create custom acknowledgement messages. You might use expressions to include information about Data Collector, the pipeline, record, or batch in the message.

For example, if you have multiple Data Collectors processing data from the same client, you might use the following record processed message to include the Data Collector host name and the pipeline title in the message, along with a record identifier:
${record:value('/id')} was processed by Data Collector: ${sdc:hostname()}, 
pipeline: ${pipeline:title()}.

You can set the time zone to use for datetime values returned by expressions. By default, the origin uses UTC.

Note: In a batch completion message, record functions return information from the last record in the batch.
You can use the batchSize variable to return the number of records included in the batch. The batchSize variable can be used only with the TCP Server origin and must be typed into the message. The batchSize variable does not appear in the expression completion list.
For example, the following message includes the number of records in the batch, the transaction ID of the last record in the batch, and the pipeline that performed the processing:
Pipeline: ${pipeline:title()} committed a batch whose last record was 
${record:value('/transactionID')} and included ${batchSize} messages.

TCP Modes

The TCP Server origin processes data differently depending on the mode that you select. The origin provides the following modes:
NetFlow messages
The TCP Server origin can process NetFlow 5 and NetFlow 9 messages. When processing NetFlow messages, the stage generates different records based on the NetFlow version. When processing NetFlow 9, the records are generated based on the NetFlow 9 configuration properties. For more information, see NetFlow Data Processing.
To process NetFlow messages, set the TCP Mode property to NetFlow. Then, for NetFlow 9 data, configure the properties on the NetFlow 9 tab. NetFlow 5 data does not require additional configuration.
syslog messages
The TCP Server origin processes syslog messages in accordance with RFC 6587, except the origin does not support method changes.
The TCP Server origin can process the following types of syslog messages:
  • RFC 5424
  • RFC 3164
  • Non-standard common messages, such as RFC 3339 dates with no version digit
To process syslog messages, set the TCP Mode property to "syslog" and configure the transfer framing mode.
Important: All TCP clients must use the same transfer framing mode to transmit data.
Use one of the following transfer framing modes:
  • Octet counting - The frame indicates the length of the syslog message and includes the entire contents of the message.
  • Non-transparent framing - The frame includes the syslog message and a user-defined trailing separator characters. The origin uses the separator characters to create records.
    Use the following Java Unicode syntax to specify a separator character:
    \u<Unicode character code>
    To define multiple characters, simply list them as a group as appropriate, such as:
    \u<Unicode character code>\u<Unicode character code>\u<Unicode character code>

    For example, the default separator character is line feed, whose Unicode character code is 000A. To specify this as the separator character, enter \u000A.

Separated records
The TCP Server origin can process the supported Data Collector data formats when the data is separated by the specified record separator characters.
To process supported data formats, set the TCP Mode property to Separated Records and specify the record separator characters. Then, specify the data format of the data and configure any related properties.
Important: All TCP clients must use the same record separator characters.
Character data with length prefix
The TCP Server origin can process the supported Data Collector data formats when passed as character-based data with a length prefix.
To process supported data formats, set the TCP Mode property to Character Data with Length Prefix and specify the character set of the data. Then, specify the data format of the data and configure any related properties.
A length prefix consists of the digits that indicate the length of the data, and a space character. The data to be converted to a record should immediately follow the space character.
Note: The length prefix must be in a single-byte encoding, such as UTF-8. The data can be in any valid character set, which you specify in the origin.

For example, say a TCP client sends the following UTF-8 data:

11 hello world
The length prefix is "11 ", which indicates that the data to be converted is 11 bytes long. The origin then converts the following 11 bytes, "hello world" to a record.

You can use this TCP mode to capture raw syslog messages that are framed with octet counting into a string field.

Flume Avro IPC Server
The TCP Server origin can process the supported Data Collector data formats when passed in Flume events as Avro messages from a Flume Avro sink. Use the TCP Server origin instead of the HTTP Server origin to more efficiently process Flume events.
To process supported data formats, set the TCP Mode property to Flume Avro IPC Server and configure the additional Bind Address property. Then, specify the data format of the data and configure any related properties.

Data Formats

In Separated Record or Character Data with Length Prefix TCP mode, the TCP Server origin processes data differently based on the data format.

The origin can also process the following types of data when separated by the appropriate record separator:
Avro
Generates a record for every message. Includes a precision and scale field attribute for each Decimal field.
The stage includes the Avro schema in an avroSchema record header attribute. You can use one of the following methods to specify the location of the Avro schema definition:
  • Message/Data Includes Schema - Use the schema in the message.
  • In Pipeline Configuration - Use the schema that you provide in the stage configuration.
  • Confluent Schema Registry - Retrieve the schema from Confluent Schema Registry. Confluent Schema Registry is a distributed storage layer for Avro schemas. You can configure the stage to look up the schema in Confluent Schema Registry by the schema ID embedded in the message or by the schema ID or subject specified in the stage configuration.
Using a schema in the stage configuration or retrieving a schema from Confluent Schema Registry overrides any schema that might be included in the message and can improve performance.
Binary
Generates a record with a single byte array field at the root of the record.
When the data exceeds the user-defined maximum data size, the origin cannot process the data. Because the record is not created, the origin cannot pass the record to the pipeline to be written as an error record. Instead, the origin generates a stage error.
Delimited
Generates a record for each delimited line. You can use the following delimited format types:
  • Default CSV - File that includes comma-separated values. Ignores empty lines in the file.
  • RFC4180 CSV - Comma-separated file that strictly follows RFC4180 guidelines.
  • MS Excel CSV - Microsoft Excel comma-separated file.
  • MySQL CSV - MySQL comma-separated file.
  • Tab-Separated Values - File that includes tab-separated values.
  • PostgreSQL CSV - PostgreSQL comma-separated file.
  • PostgreSQL Text - PostgreSQL text file.
  • Custom - File that uses user-defined delimiter, escape, and quote characters.
  • Multi Character Delimited - File that uses multiple user-defined characters to delimit fields and lines, and single user-defined escape and quote characters.
You can use a list or list-map root field type for delimited data, and optionally include field names from a header line, when available. For more information about the root field types, see Delimited Data Root Field Type.
When using a header line, you can enable handling records with additional columns. The additional columns are named using a custom prefix and integers in sequential increasing order, such as _extra_1, _extra_2. When you disallow additional columns, records that include additional columns are sent to error.
You can also replace a string constant with null values.
When a record exceeds the maximum record length defined for the stage, the stage processes the object based on the error handling configured for the stage.
JSON
Generates a record for each JSON object. You can process JSON files that include multiple JSON objects or a single JSON array.
When an object exceeds the maximum object length defined for the origin, the origin processes the object based on the error handling configured for the stage.
Log
Generates a record for every log line.
When a line exceeds the user-defined maximum line length, the origin truncates longer lines.
You can include the processed log line as a field in the record. If the log line is truncated, and you request the log line in the record, the origin includes the truncated line.
You can define the log format or type to be read.
Protobuf
Generates a record for every protobuf message. By default, the origin assumes messages contain multiple protobuf messages.
Protobuf messages must match the specified message type and be described in the descriptor file.
When the data for a record exceeds 1 MB, the origin cannot continue processing data in the message. The origin handles the message based on the stage error handling property and continues reading the next message.
For information about generating the descriptor file, see Protobuf Data Format Prerequisites.
SDC Record
Generates a record for every record. Use to process records generated by a Data Collector pipeline using the SDC Record data format.
For error records, the origin provides the original record as read from the origin in the original pipeline, as well as error information that you can use to correct the record.
When processing error records, the origin expects the error file names and contents as generated by the original pipeline.
Text
Generates a record for each line of text or for each section of text based on a custom delimiter.
When a line or section exceeds the maximum line length defined for the origin, the origin truncates it. The origin adds a boolean field named Truncated to indicate if the line was truncated.
For more information about processing text with a custom delimiter, see Text Data Format with Custom Delimiters.
XML
Generates records based on a user-defined delimiter element. Use an XML element directly under the root element or define a simplified XPath expression. If you do not define a delimiter element, the origin treats the XML file as a single record.
Generated records include XML attributes and namespace declarations as fields in the record by default. You can configure the stage to include them in the record as field attributes.
You can include XPath information for each parsed XML element and XML attribute in field attributes. This also places each namespace in an xmlns record header attribute.
Note: Field attributes and record header attributes are written to destination systems automatically only when you use the SDC RPC data format in destinations. For more information about working with field attributes and record header attributes, and how to include them in records, see Field Attributes and Record Header Attributes.
When a record exceeds the user-defined maximum record length, the origin skips the record and continues processing with the next record. It sends the skipped record to the pipeline for error handling.
Use the XML data format to process valid XML documents. For more information about XML processing, see Reading and Processing XML Data.
Tip: If you want to process invalid XML documents, you can try using the text data format with custom delimiters. For more information, see Processing XML Data with Custom Delimiters.

Configuring a TCP Server Origin

Configure a TCP Server origin to process data provided through TCP/IP connections.
  1. In the Properties panel, on the General tab, configure the following properties:
    General Property Description
    Name Stage name.
    Description Optional description.
    On Record Error Error record handling for the stage:
    • Discard - Discards the record.
    • Send to Error - Sends the record to the pipeline for error handling.
    • Stop Pipeline - Stops the pipeline.
  2. On the TCP tab, configure the following properties:
    TCP Property Description
    Port Port number to listen to for data. You can specify multiple port numbers.
    Note: No other pipelines or processes can already be bound to the listening port. The listening port can be used only by a single pipeline.
    Bind Address Bind address. Use the default, 0.0.0.0, to bind to all IPv4 addresses on the Data Collector machine.

    Used only with the Flume Avro IPC Server TCP mode.

    Enable Native Transports (Epoll) On 64-bit Linux machines, enables the use of native Epoll transports. Use to improve pipeline performance.
    Number of Receiver Threads Number of receiver threads to use for each port. For example, if you configure two threads per port and configure the origin to use three ports, the origin uses a total of six threads.

    This property determines how many threads the origin generates and uses for multithreaded processing. For more information, see Multithreaded Processing.

    Minimum number of threads is 1.

    TCP Mode TCP mode to use. Select one of the following options:
    • NetFlow
    • syslog
    • Separated records - Use to process supported Data Collector data formats that are separated by separator characters.
    • Character data with length prefix - Use to process supported Data Collector data formats passed as character data with a length prefix.

      The length prefix must be in a single-byte encoding, such as UTF-8. For more information, see TCP Modes.

    • Flume Avro IPC Server - Use to process supported Data Collector data formats passed in Flume events as Avro messages.
    Charset Character set of the data to be processed.

    Used only with the Character-Based with Length Prefix TCP mode.

    Record Separator One or more characters used by TCP clients to separate records.

    Specify one or more characters using the Java Unicode syntax, as follows: \u<Unicode character code>. To specify multiple characters, repeat the syntax for each character, as follows: \u<Unicode character code>\u<Unicode character code>\u<Unicode character code>.

    Max Batch Size (messages) Maximum number of messages to include in a batch and pass through the pipeline at one time. Honors values up to the Data Collector maximum batch size.

    Default is 1000. The Data Collector default is 1000.

    Batch Wait Time (ms) Number of milliseconds to wait before sending a partial or empty batch.
    Max Message Size (bytes) Maximum message size in bytes to be converted into a record.

    When a message is larger than the maximum message size, the origin disconnects from the originating client and passes the record to the pipeline for error handling.

    Charset Character set to use when sending acknowledgements.
    Ack Time Zone Time zone to use for acknowledgement messages. Any dates returned by functions are adjusted to the specified time zone.
    Record Processed Ack Message Acknowledgement message to send after processing a record. When configured, the origin sends a message after processing each record.

    You can use expressions to include additional information in the message. For more information, see Using Expressions in Messages.

    By default, no acknowledgement is sent.

    Batch Completed Ack Message Acknowledgement message to send after processing a batch. When configured, the origin sends a message after each batch of data is committed to all destinations.

    You can use expressions to include additional information in the message. Record functions return information from the last record in the batch. For more information, see Using Expressions in Messages.

    By default, no acknowledgement is sent.

    Read Timeout (seconds) Amount of time that a connection can be open without reading any data. After this amount of idle time, Data Collector closes the connection. Specify in seconds. Minimum value is 1, and maximum value is 3,600.

    Default is 300.

  3. When processing data in Syslog TCP mode, on the Syslog tab, configure the following properties:
    Syslog Property Description
    Syslog Message Transfer Framing Mode The framing mode that the TCP clients use to pass the data. Use one of the following options:
    • Octet Counting - The message is entirely enclosed in the frame.
    • Non-transparent-framing - The message includes trailing separator characters to indicate the end of the message.
    Non-transparent-framing Separator One or more separator characters used to separate records.

    Specify one or more characters using the Java Unicode syntax, as follows: \u<Unicode character code>. To specify multiple characters, repeat the syntax for each character, as follows: \u<Unicode character code>\u<Unicode character code>\u<Unicode character code>.

    Used with the non-transparent framing mode only.

    Charset Character encoding of the data to be processed.
  4. When processing data in Separated Record, Character Data with Length Prefix, or Flume Avro IPC Server TCP mode, click the Data Formats tab and configure the Data Format of the data.
  5. For Avro data, on the Data Format tab, configure the following properties:
    Avro Property Description
    Avro Schema Location Location of the Avro schema definition to use when processing data:
    • Message/Data Includes Schema - Use the schema in the message.
    • In Pipeline Configuration - Use the schema provided in the stage configuration.
    • Confluent Schema Registry - Retrieve the schema from the Confluent Schema Registry.

    Using a schema in the stage configuration or in the Confluent Schema Registry can improve performance.

    Avro Schema Avro schema definition used to process the data. Overrides any existing schema definitions associated with the data.

    You can optionally use the runtime:loadResource function to use a schema definition stored in a runtime resource file.

    Schema Registry URLs Confluent Schema Registry URLs used to look up the schema. To add a URL, click Add. Use the following format to enter the URL:
    http://<host name>:<port number>
    Lookup Schema By Method used to look up the schema in the Confluent Schema Registry:
    • Subject - Look up the specified Avro schema subject.
    • Schema ID - Look up the specified Avro schema ID.
    • Embedded Schema ID - Look up the Avro schema ID embedded in each message.
    Overrides any existing schema definitions associated with the message.
    Schema Subject Avro schema subject to look up in the Confluent Schema Registry.

    If the specified subject has multiple schema versions, the origin uses the latest schema version for that subject. To use an older version, find the corresponding schema ID, and then set the Look Up Schema By property to Schema ID.

    Schema ID Avro schema ID to look up in the Confluent Schema Registry.
  6. For binary data, on the Data Format tab, configure the following properties:
    Binary Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

    Max Data Size (bytes) Maximum number of bytes in the message. Larger messages cannot be processed or written to error.
  7. For delimited data, on the Data Format tab, configure the following properties:
    Delimited Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

    Delimiter Format Type Delimiter format type. Use one of the following options:
    • Default CSV - File that includes comma-separated values. Ignores empty lines in the file.
    • RFC4180 CSV - Comma-separated file that strictly follows RFC4180 guidelines.
    • MS Excel CSV - Microsoft Excel comma-separated file.
    • MySQL CSV - MySQL comma-separated file.
    • Tab-Separated Values - File that includes tab-separated values.
    • PostgreSQL CSV - PostgreSQL comma-separated file.
    • PostgreSQL Text - PostgreSQL text file.
    • Custom - File that uses user-defined delimiter, escape, and quote characters.
    • Multi Character Delimited - File that uses multiple user-defined characters to delimit fields and lines, and single user-defined escape and quote characters.
    Header Line Indicates whether a file contains a header line, and whether to use the header line.
    Allow Extra Columns When processing data with a header line, allows processing records with more columns than exist in the header line.
    Extra Column Prefix Prefix to use for any additional columns. Extra columns are named using the prefix and sequential increasing integers as follows: <prefix><integer>.

    For example, _extra_1. Default is _extra_.

    Max Record Length (chars) Maximum length of a record in characters. Longer records are not read.

    This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.

    Delimiter Character Delimiter character for a custom delimiter format. Select one of the available options or use Other to enter a custom character.

    You can enter a Unicode control character using the format \uNNNN, where ​N is a hexadecimal digit from the numbers 0-9 or the letters A-F. For example, enter \u0000 to use the null character as the delimiter or \u2028 to use a line separator as the delimiter.

    Default is the pipe character ( | ).

    Multi Character Field Delimiter Characters that delimit fields for multi-character delimiter format.

    Default is two pipe characters (||).

    Multi Character Line Delimiter Characters that delimit lines or records for multi-character delimiter format.

    Default is the newline character (\n).

    Escape Character Escape character for a custom or multi-character delimiter format.
    Quote Character Quote character for a custom or multi-character delimiter format.
    Enable Comments Allows commented data to be ignored for custom delimiter format.
    Comment Marker Character that marks a comment when comments are enabled for custom delimiter format.
    Ignore Empty Lines Allows empty lines to be ignored for custom delimiter format.
    Root Field Type Root field type to use:
    • List-Map - Generates an indexed list of data. Enables you to use standard functions to process data. Use for new pipelines.
    • List - Generates a record with an indexed list with a map for header and value. Requires the use of delimited data functions to process data. Use only to maintain pipelines created before 1.1.0.
    Lines to Skip Number of lines to skip before reading data.
    Parse NULLs Replaces the specified string constant with null values.
    NULL Constant String constant to replace with null values.
    Charset Character encoding of the files to be processed.
    Ignore Control Characters Removes all ASCII control characters except for the tab, line feed, and carriage return characters.
  8. For JSON data, on the Data Format tab, configure the following properties:
    JSON Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

    JSON Content Type of JSON content. Use one of the following options:
    • Array of Objects
    • Multiple Objects
    Maximum Object Length (chars) Maximum number of characters in a JSON object.

    Longer objects are diverted to the pipeline for error handling.

    This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.

    Charset Character encoding of the files to be processed.
    Ignore Control Characters Removes all ASCII control characters except for the tab, line feed, and carriage return characters.
  9. For log data, on the Data Format tab, configure the following properties:
    Log Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

    Log Format Format of the log files. Use one of the following options:
    • Common Log Format
    • Combined Log Format
    • Apache Error Log Format
    • Apache Access Log Custom Format
    • Regular Expression
    • Grok Pattern
    • Log4j
    • Common Event Format (CEF)
    • Log Event Extended Format (LEEF)
    Max Line Length Maximum length of a log line. The origin truncates longer lines.

    This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.

    Retain Original Line Determines how to treat the original log line. Select to include the original log line as a field in the resulting record.

    By default, the original line is discarded.

    Charset Character encoding of the files to be processed.
    Ignore Control Characters Removes all ASCII control characters except for the tab, line feed, and carriage return characters.
    • When you select Apache Access Log Custom Format, use Apache log format strings to define the Custom Log Format.
    • When you select Regular Expression, enter the regular expression that describes the log format, and then map the fields that you want to include to each regular expression group.
    • When you select Grok Pattern, you can use the Grok Pattern Definition field to define custom grok patterns. You can define a pattern on each line.

      In the Grok Pattern field, enter the pattern to use to parse the log. You can use a predefined grok patterns or create a custom grok pattern using patterns defined in Grok Pattern Definition.

      For more information about defining grok patterns and supported grok patterns, see Defining Grok Patterns.

    • When you select Log4j, define the following properties:
      Log4j Property Description
      On Parse Error Determines how to handle information that cannot be parsed:
      • Skip and Log Error - Skips reading the line and logs a stage error.
      • Skip, No Error - Skips reading the line and does not log an error.
      • Include as Stack Trace - Includes information that cannot be parsed as a stack trace to the previously-read log line. The information is added to the message field for the last valid log line.
      Use Custom Log Format Allows you to define a custom log format.
      Custom Format Use log4j variables to define a custom log format.
  10. For protobuf data, on the Data Format tab, configure the following properties:
    Protobuf Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

    Protobuf Descriptor File Descriptor file (.desc) to use. The descriptor file must be in the Data Collector resources directory, $SDC_RESOURCES.

    For more information about environment variables, see Data Collector Environment Configuration. For information about generating the descriptor file, see Protobuf Data Format Prerequisites.

    Message Type The fully-qualified name for the message type to use when reading data.

    Use the following format: <package name>.<message type>.

    Use a message type defined in the descriptor file.
    Delimited Messages Indicates if a file might include more than one protobuf message.
  11. For SDC Record data, on the Data Format tab, configure the following properties:
    SDC Record Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

  12. For text data, on the Data Format tab, configure the following properties:
    Text Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    File Name Pattern within Compressed Directory For archive and compressed archive files, file name pattern that represents the files to process within the compressed directory. You can use UNIX-style wildcards, such as an asterisk or question mark. For example, *.json.

    Default is *, which processes all files.

    Max Line Length Maximum number of characters allowed for a line. Longer lines are truncated.

    Adds a boolean field to the record to indicate if it was truncated. The field name is Truncated.

    This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.

    Use Custom Delimiter Uses custom delimiters to define records instead of line breaks.
    Custom Delimiter One or more characters to use to define records.
    Include Custom Delimiter Includes delimiter characters in the record.
    Charset Character encoding of the files to be processed.
    Ignore Control Characters Removes all ASCII control characters except for the tab, line feed, and carriage return characters.
  13. For XML data, on the Data Format tab, configure the following properties:
    XML Property Description
    Compression Format The compression format of the files:
    • None - Processes only uncompressed files.
    • Compressed File - Processes files compressed by the supported compression formats.
    • Archive - Processes files archived by the supported archive formats.
    • Compressed Archive - Processes files archived and compressed by the supported archive and compression formats.
    Delimiter Element
    Delimiter to use to generate records. Omit a delimiter to treat the entire XML document as one record. Use one of the following:
    • An XML element directly under the root element.

      Use the XML element name without surrounding angle brackets ( < > ) . For example, msg instead of <msg>.

    • A simplified XPath expression that specifies the data to use.

      Use a simplified XPath expression to access data deeper in the XML document or data that requires a more complex access method.

      For more information about valid syntax, see Simplified XPath Syntax.

    Include Field XPaths Includes the XPath to each parsed XML element and XML attribute in field attributes. Also includes each namespace in an xmlns record header attribute.

    When not selected, this information is not included in the record. By default, the property is not selected.

    Note: Field attributes and record header attributes are written to destination systems automatically only when you use the SDC RPC data format in destinations. For more information about working with field attributes and record header attributes, and how to include them in records, see Field Attributes and Record Header Attributes.
    Namespaces Namespace prefix and URI to use when parsing the XML document. Define namespaces when the XML element being used includes a namespace prefix or when the XPath expression includes namespaces.

    For information about using namespaces with an XML element, see Using XML Elements with Namespaces.

    For information about using namespaces with XPath expressions, see Using XPath Expressions with Namespaces.

    Using simple or bulk edit mode, click the Add icon to add additional namespaces.

    Output Field Attributes Includes XML attributes and namespace declarations in the record as field attributes. When not selected, XML attributes and namespace declarations are included in the record as fields.
    Note: Field attributes are automatically included in records written to destination systems only when you use the SDC RPC data format in the destination. For more information about working with field attributes, see Field Attributes.

    By default, the property is not selected.

    Max Record Length (chars)

    The maximum number of characters in a record. Longer records are diverted to the pipeline for error handling.

    This property can be limited by the Data Collector parser buffer size. For more information, see Maximum Record Size.

    Charset Character encoding of the files to be processed.
    Ignore Control Characters Removes all ASCII control characters except for the tab, line feed, and carriage return characters.
  14. To use SSL/TLS, click the TLS tab and configure the following properties:
    TLS Property Description
    Use TLS

    Enables the use of TLS.

    Keystore File Path to the keystore file. Enter an absolute path to the file or a path relative to the Data Collector resources directory: $SDC_RESOURCES.

    For more information about environment variables, see Data Collector Environment Configuration.

    By default, no keystore is used.

    Keystore Type Type of keystore to use. Use one of the following types:
    • Java Keystore File (JKS)
    • PKCS #12 (p12 file)

    Default is Java Keystore File (JKS).

    Keystore Password Password to the keystore file. A password is optional, but recommended.
    Tip: To secure sensitive information such as passwords, you can use runtime resources or credential stores.
    Keystore Key Algorithm The algorithm used to manage the keystore.

    Default is SunX509.

    Use Default Protocols Determines the transport layer security (TLS) protocol to use. The default protocol is TLSv1.2. To use a different protocol, clear this option.
    Transport Protocols The TLS protocols to use. To use a protocol other than the default TLSv1.2, click the Add icon and enter the protocol name. You can use simple or bulk edit mode to add protocols.
    Note: Older protocols are not as secure as TLSv1.2.
    Use Default Cipher Suites Determines the default cipher suite to use when performing the SSL/TLS handshake. To use a different cipher suite, clear this option.
    Cipher Suites Cipher suites to use. To use a cipher suite that is not a part of the default set, click the Add icon and enter the name of the cipher suite. You can use simple or bulk edit mode to add cipher suites.

    Enter the Java Secure Socket Extension (JSSE) name for the additional cipher suites that you want to use.

  15. For NetFlow 9 data, on the NetFlow 9 tab, configure the following properties:
    When processing earlier versions of NetFlow data, these properties are ignored.
    Netflow 9 Property Description
    Record Generation Mode Determines the type of values to include in the record. Select one of the following options:
    • Raw Only
    • Interpreted Only
    • Both Raw and Interpreted
    Max Templates in Cache The maximum number of templates to store in the template cache. For more information about templates, see Caching NetFlow 9 Templates.

    Default is -1 for an unlimited cache size.

    Template Cache Timeout (ms) The maximum number of milliseconds to cache an idle template. Templates unused for more than the specified time are evicted from the cache. For more information about templates, see Caching NetFlow 9 Templates.

    Default is -1 for caching templates indefinitely.