#logstash

New news from newjiraissues: Duy Long created LOGSTASH-985 - Add newline with gsub <https://logstash.jira.com/browse/LOGSTASH-985>; || bob walker created LOGSTASH-928 - elasticsearch_river should support redis <https://logstash.jira.com/browse/LOGSTASH-928>;

with logstash and elasticsearch, how do i test if the logs i am sending to logstash are making their way in to elastic search?

asc_: turn on the built in web interface from the logstash jar, or use curl to make a query. check the getting started guides on the logstash site under docs.

bah, my first attempt to rid myself of warnings failed.

`rpm

nemish: Error: "rpm" is not a valid command.

`packages

nemish: Error: "packages" is not a valid command.

`help

nemish: help [<plugin>] [<command>]

nemish: what are you trying to do?

with logstashbot

semiosis: i figured it out... was trying to find instructions for how to build rpm from source... but figured it out

ah ok. logstashbot probably doesnt know that, yet

anyone using the the rsyslog -> redis plugin successfully? https://github.com/sami-bouafif/rsyslog-redis

Title: sami-bouafif/rsyslog-redis · GitHub (at github.com)

New news from newjiraissues: Lucas Bremgartner created LOGSTASH-1353 - Exception: source sequence is illegal/malformed utf-8 <https://logstash.jira.com/browse/LOGSTASH-1353>;

whitefinch: I did logstash behind haproxy with traditional rsyslog in tcp instead

mfn: oh sorry to hear that. Luckily it works for me with 1.2.0, I got the malformed UTF-8 since I upgraded to 1.2.1

can anyone do a conditional for \?

if [user] =~ /\\// { }

i can't get it to work

rashidkpc: i know we spoke about splitting up username from DOMAIN\user... what's the easiest way to do this? using split makes an array rather than domain and user field?

nemish: you could probably then use mutate to put them in individual fields

rashidkpc: okay but how do you call array parts? so user gets converted to user[0] and user[1] where user[0] is domain from what you are saying... how do you use mutate to say add_field => ["domain", %{user[0]}" ]

Is there a good guide to upgrade logstash server from 1.1.13 to 1.2.1?

I am using kibana3, and I lost all my data once I started 1.2.1

gown: what do you mean, you lost all your data? your data in elasticsearch was lost?

nemish: good question, you could also use grok instead of split

gowen: sorry, spell checker keeps correcting your name