#logstash

both those lines have no grokparsefailure as is... you have more example lines that you know it breaks on?

yup

hold up

rashidkpc: are you around ?

byye :)

nemish: I'm just changing the script with the date to be "ISO8601" so I can get you the payloads that have the errors

what's wrong with the date pattern you have?

not the pattern (match) for the logs

I think that is fine

the date match is fine too

hmmm

wait...

whack: you still around?

ran a couple of test

and they seem fine *sigh*

smh

:)

I need to configure logstash as a service

*sigh*

nemish give me one minute

nemish: found one! https://www.evernote.com/shard/s15/sh/834f5836-...

<http://goo.gl/lsVB4B>; (at www.evernote.com)

mfolivas: i can't copy and paste a screenshot can you send me the log line?

nemish: yup

I just updated the gists

it should be there

nemish: https://gist.github.com/mfolivas/6685417

Title: Configuration for logstash 1.2.1 (at gist.github.com)

mfolivas: works fine

mfolivas: back

nemish: hey!

I'm looking at the output plugins which ship the logs over a tcp connection (such as the syslog or tcp plugins). What is logstash's behaviour when the connection goes down? WIll it stop consuming logs until the output becomes available again?

New news from newjiraissues: David G created LOGSTASH-1328 - Encoding issue with JSON causing elasticsearch to reset the connection <https://logstash.jira.com/browse/LOGSTASH-1328>;

rashidkpc: whack how do you update ES plugin for kibana

tried plugin -remove kibana; plugin -install elasticsearch/kibana

gives Oops error

logstashbot: whoami

can anyone hear me? pls pong me!

semiosis: I don't recognize you.

never mind the pongs, thx anyway :)

logstashbot: whoami

semiosis: semiosis

logstashbot: who's your daddy?

semiosis: Error: "who's" is not a valid command.

ok then

if I am looking to use wildcards in a text search, if I put something like "looking*text" in the web interface it comes up with 0 results

I assume I'm doing something totally and completely amateur

ah nvm, got it!

amclay: well, what was the solution?!