Search code examples
clojureriemann

Injecting new field to riemann event

I'm probably not understanding some key concepts in riemann/clojure. I'm trying to parse field :service from event which is in format "aaa:1234.bbbb.cccc.ddddd", and add new field pid to the event using function "with". Anybody can explain to me why this code in riemann.config is throwing exception:

...
(let [index (default :ttl 300 (update-index (index)))]

 ; Inbound events will be passed to these streams:
 (streams
 index
 (where (service #"(\w+):(\d+)\.(\w+)\.(\w+)\.(\w+)")
   (with :pid (str/replace service #"(\w+):(\d+)\.(\w+)\.(\w+)\.(\w+)" "$2")
)
)
...

user=> (riemann.bin/reload!)
#error {
 :cause "Unable to resolve symbol: service in this context"
 :via
 [{:type clojure.lang.Compiler$CompilerException
 :message "java.lang.RuntimeException: Unable to resolve symbol: service in this context, compiling:(/etc/riemann/riemann.config:73:19)"
Solution

  • I guess (where (service ,,,)) is just syntactic sugar by the where macro for (where* (fn [event] (let [service (:service event)] ,,,))), which is why you can't use service in the body of where: it is not a defined name there.

    Looking at the documentation for with, it seems to me you should use smap:

    (where (service #"(\w+):(\d+)\.(\w+)\.(\w+)\.(\w+)")
   (smap (fn [e] (assoc e :pid (str/replace (:service e) #"(\w+):(\d+)\.(\w+)\.(\w+)\.(\w+)" "$2")))))