#logstash

this stuff is confusing as heck

dear god, am I retarded? I can't learn grok

Hello! I'm having some troublw with the Twitter input for Logstash. I get an error "A plugin had an unrecoverable error. Will restart this plugin." as seen at the bottom of this page: https://logstash.jira.com/browse/LOGSTASH-1435 Does anyone have any ideas on that?

Title: [LOGSTASH-1435] twitter input plugin is broken - logstash.jira.com (at logstash.jira.com)

sy5error: I'd love to help if you have something you want to look at together.

sy5error: ha

sy5error: what's your malfunction?

perhaps we can help

so i'm basically using this right now - http://cookbook.logstash.net/recipes/syslog-pri/

Title: parsing syslog messages - logstash cookbook (at cookbook.logstash.net)

I just want a couple separate fields for:

"client IP" "domain hit" "request URI" "status code"

extracted from the syslog message I guess

so it will be nice and neat in Kibana

sy5error: do you know of grokdebug?

the one you showed me

the debugger

ya

what about it

sy5error: If you post a sample syslog line, I can help with the Grok expression.

ok

hi, I'm getting this error on latest Kibana => Cross origin requests are only supported for HTTP

that's the javascript error.. kibana error is => Error Could not reach host:9200/_aliases. If you are using a proxy, ensure it is configured correctly

m2matson: I haven't seen that one yet. Are you using the Kibana that's built into LogStash 1.2.2? And where does the error message show up?

the built in one seems to work fine.. tarball of latest does not

GregMefford: in the browser

m2matson: Ah, so this is not the built-in one.

right

GregMefford: thanks man

is there a way to bind to port 80 using 1.2.2 built-in kibana?

m2matson: no. Download upstream kibana and put it behind apache/nginx for that

torrancew: got it, that's how my broken one is setup

ah

Yeah, I don't believe it's configurable, and regardless, you probably shouldn't run a great big ball of java+ruby as root on your servers ;)

yeah ;) was just gonna do that as temp solution