#logstash

lets try out the flatjar

largest node name to date 'Lilith, the daughter of Dracula' from log stash ES

hello

i am trying to read querylogs using logstash and I am getting the error that the files can't be opened. I have made sure that logfiles do have read/write permissions for root and i have disabled also selinux

any suggestions would be helpful

{:timestamp=>"2013-07-07T16:13:09.350000+0000", :message=>"failed to open /opt/fast/esp/var/log/querylogs/query_log.20130520230000: No such file or directory -

I'm failing at life right now. testing out kibana3 behind nginx and it's not rendering the css etc. not seeing any errors in the logs... but if I run it with the sample node app it renders correctly

I have > 100 grok expressions in my filter section - is it possible to put them in an external file?

(the patterns already are)

MartinCleaver: Yeah, you can break you configs into multiple files and point logstash at the dir

ah, thanks paulczar

I usually use a pattern link 00_input_blah .conf 50_filter_blah.conf 99_output_blah.conf

the numbers help with the ordering

oh, yeah. Definitely

thanks

Title: logstash config example [root@app-gcios-001 config]# pwd /etc/logstash/agent - Pastebin.com (at pastebin.com)

thanks dpippen

right-o: http://logstash.net/docs/1.1.13/flags says -f, --config CONFIGFILE Load the logstash config from a specific file, directory, or a wildcard. If given a directory or wildcard, config files will be read from the directory in alphabetical order.

Title: logstash - open source log management (at logstash.net)

in input -> file, path is said to have to be an absolute path - is there a way around that? I share a dev configuration with a colleague and we each have a different path to use (without using the wildcard -f… which would probably work but seems a bit random)

oh, and I guess filter { grok {} grok {} } === filter { grok {} }; filter {grok {}} ?