#logstash

anyone using or tried the go version of lumberjack?

hazmat: it's not done yet

whack, any idea what's missing?

hmm.. tls vs crypto on top of zmq.

whack: what was it about the TLS go package which you didn't like?

hmm, got disconnected :-/

Is there a way to load pattern files while logstash is running so I can debug grok filters?

I'm aware of the grok debugger app.. but it does not seem to be helpful for testing my filters.

For instance I'm looking for SLUG ([0-9][0-9]?[A,P])\_([0-9][0-9][0-9][0-9])

kevin_: you will always need to restart logstash to read out the patterns. it collects them at start-up

Putting at in the pattern field and 5P_0523 for instance in input field returns nothign..

nothing**

Ah-ha.. thought that might be the case.

;-)

Know of any other good tricks for writting grok filters?

Or rather testing them in logstash

you could put it in a spec test.

https://github.com/logstash/logstash/blob/maste... <-- example

<http://goo.gl/poKIr>; (at github.com)

Hmm... I did not know that was possible.

Awesome, thank you for the advice

your welcome :-)

Hmm... although not entirely sure how to run those : )

java -jar logstash.jar rspec /path/to/rspec/file

deares: idk, i mostly start in the grokdebug site, have a logstash instance set up with stdin / grok filter / stdout filter

run in -v

that's also possible yeah :-)

deares: https://code.google.com/p/semicomplete/wiki/Gro... <- i've come acros a few things like that

<http://goo.gl/Ljgqf>; (at code.google.com)

deares: if you get empty braces your pattern has matche

s/matche/matched/

otherwise you will get "no matches" or Compile ERROR

5P_0523 with ([0-9][0-9]?[A,P])\_([0-9][0-9][0-9][0-9]) returns {} in grokdebug

artbikes: that's because its not a named capture i believe.

I've never quite grokked all the options on the debugger screen :)

can't remember what to add to its a named capture... whack ??

if you want to seem some output, use %{NUMBER} instead of [0-9]

%{WORD}_%{NUMBER} might work better

or differently the same anyways

Btw, the 4 x [0-9] you can also do [0-9]{4}

and the first one can be [0-9]{1,2}

(?<name>[0-9]{1,2}?[A,P]\_([0-9]{4})) <-- named capture :-)

SP_0523 works with that

sorry 5P_0523

of course when you put it in a patterns file you only need to set the regex in there.

New news from newjiraissues: Peter Butkovic created LOGSTASH-1015 - Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (IOError) no !/ in spec <https://logstash.jira.com/browse/LOGSTASH-1015>;

time for me to catch some sleep.. 3:40 am :-)

later dude

see you all tomorrow

Stoosh: the API (much like most things in go's standard library) is awkward and incomplete or generally makes simple things hard.

hazmat: what's missing from go lumberjack - the protocol isn't necessarily complete yet. I also haven't implemented state tracking (recording where in files it's last read from)

whack: fair enough :)

Stoosh: thankfully cgo is super easy so if I really wanted to, I'd just invoke openssl from go instead

yea cgo is pretty nice

by far the best ffi-like api I've used

Stoosh: unfortunately there's not too much I like about Go :\

whack: haha I got that impression

I love the focus on compile speed

dang window focus

Blah

is there a changelog for 1.1.3?

1.1.13 I mean

<http://goo.gl/Bu6QG>; (at github.com)

stonith: ^^

Stoosh: thanks!