#logstash

MisterHatt: Many thanks!

Cheers.

np o/

Arggg. What does "AMQP connection error, will reconnect: execution expired {:level=>:error}" mean when I run logstash?

I mean, it looks pretty obvious...

But I think I've got all settings correct.

input or output?

input.

amqp or rabbitmq?

rabbitmq now, but they both do the same thing.

jruby?

? no clue. I'm running "java -jar logstash-1.1.13-flatjar.jar agent -f indexer.conf" if that helps. Sorry to be such a newb.

no problem, that's jruby then

can you pastebin your indexer.conf?

Actually more of a kibana question... I've started playing around with manually creating a mapping config for my ES instance where my logstash sends its output. Working very well so far. I decided to be a little more adventurous and tried setting one of the fields to type 'ip' and it seems to work. It shows up in kibana (mostly) fine, it shows up fine when I use curl to do a test query from the commandline (with or without 'pretty' flipped on

also, a what stage of running logstash does that happen? looks like what I'd expect if you ^c'd it

Title: [Ruby] input { rabbitmq { queue => 'logstash-queue' type => 'direct' - Pastebin.com (at pastebin.com)

As soon as I start it up. it just repeats it over and over.

ahhh one sec

I think I'm an idiot...

got any output from the RabbitMQ log?

copy/paste host issue. ugh. Ok, on to next problem. Thanks MisterHatt.

oh right, lol

was gonna ask if it was running on the correct host/port if there was nothing in rmq log :)

Yeah, I'd just looked there and was puzzled why there wasn't anything. :)

ok, I've got it working now beaver -> rabbitmq -> logstash

next step… elasticsearch. That should be the easy bit! :)

hey all - is there a tidy way for multiline to deal with busted amavisd log entries?

pretty much the same format problem as in http://bugs.debian.org/cgi-bin/bugreport.cgi?bu...

<http://goo.gl/jkqhTA>; (at bugs.debian.org)

I could figure it out if it wasn't starting the second line with the usual syslog stuff

Thanks a lot, MisterHatt. Cheers!

o/

I don't suppose whack is about?

maybe :)

i expect he still has a cold

bleh :/

I figured he could best answer a multiline filter question

Can anyone help me understand how to organize my logs. For example, I want to capture IRC chat, as well as /var/log/secure. It seems odd to have these both just go into fields on the dash board. I'm confused on how to seperate the data. I want to be able to have 1 dash board that shows authentication related stuff, and another that capture chat and other social logs which i will add

Socket-: you name each input as a type, then enact filters/outputs on each type

it also helps to have multiple inputs at times

'seen mixmuffins

`seen mixmuffins

DanielRedOak: mixmuffins was last seen in #logstash 1 week, 6 days, 5 hours, 14 minutes, and 18 seconds ago: <MixMuffins> aka: I've got a mispelling.

anyone used MixMMuffins' puppet module since lumberjack2-hack was merged into the main branch?

not unless it works with chef

;-)

haha

that must mean you weren't at puppetconf last week :)

hey guys

anyone know an easy way to grok every \t

08/28/2013 22:52:51.78 \tw3wp.exe (0x08AC) \t0x0DF8\tSharePoint Foundation \tMonitoring \tb4ly\tMedium \tLeaving Monitored Scope (Request (GET:http://sitename:80/technology/NewsRoom/elvis/Lists/elvistix20/elvistix3.aspx)). Execution Time=383.383125173773\tdf5724c7-abeb-4fb4-b622-d9bf77e2393f