#logstash

morning folks

hiya feylya

how goes?

not to bad.. an other 2,5 hour of work to go. and there?

not too bad

although, our mongo host just rebooted a bunch of boxes

hmm that's never nice

it's not great

and I'm fighting with Nagios's wonderful eccentricities too

feylya: it certainly has many of those.

Hey, electrical.

way too many of them

I still love the thing though

Anyhoo. Got OAUTH2 working; got LDAP working. I can call it a night. Seeya.

i have two different pattern for grok

i am tagging the message on the pattern

now i have third pattern

which i want to execute when two pattern doesn't match

how can we do that???

electrical??

it seems after matching one grep pattern

logstash is trying to match other patterns also

bcoz i am getting _grok parse failure

howevere i verified the grok pattern are absolutely fine

how to stop the flow of parsing if one grok pattern is succesfull

bodik???

re u thre??

how to negate the match pattern in grep

???

grep -v

vks: read the docs please..

electrical: oc

electrical : i read the doc

i am getting _grokparsefailure in tag array with my tags

can anybody would point out what the problem is???

though my all the tags are present

why this additional _grokparsefailure

vks, You get that extra tag when a grok filter failed to match the event with the pattern

thats true electrical

my patterns are fine , i had checked in grok debugger

all ny defined tags are perfect

but i am getting this additona tag

this is because i have multiple grep pattern in my configuration file???

i am setting in grep drop => false

so that if one grep pattern doesn't match , other pgrep pattern should match

bodik??

Hi, How can I rename a "child" field like @fields.geoip.country_code2 ? I can only rename "geoip" using mutate filter... ! Or better : how can i remove the "@fields" from all field ? thank you !

electrical ???

sorry got D/C'ed. what was your question vks ?

anyone here uses resque for background jobs ?

gyre007, how do you mean for background jobs? ( never heard of resque tbh )

electrical: https://github.com/resque/resque

Title: resque/resque · GitHub (at github.com)

sometimes you have jobs you want to do aync

queue them for asynch processing

that's pretty cool :-)

never used it obviously :p

Hi, How can I rename a field like @fields.geoip.country_code2 ? I can only rename "geoip" using mutate filter... ! Or better : how can i remove the "@fields" from all field ? thank you !

jsm-oxa, not sure if renaming deep fields is possible. need to check the test code for that.

and how do you mean removing @fields from all field?

damn wrong channel

aarrrrrrrgggh

sorry guys :)

hahaha no worries gyre007 :-)

when I use grok, event are registered in @fields.something, and they are displayed in kibana. I want to remove the @fields, it more pretty

ah, you want to remove the @fields part so you remove a level.. that's not possible at the moment with the current design.

i know work is in progress to change that.

electrical : suppose i am grepping for a word in syslog message and if the match is unsuccesfull i want parsing should not happen