#logstash

New news from newjiraissues: Andrei Faber created LOGSTASH-1430 - logstash client is "freezing" sometimes <https://logstash.jira.com/browse/LOGSTASH-1430>;

Hi all. Just saw some notes about _refresh. Does this mean that I can change the template of an existing populated index and then call _refresh so that it automatically reindexes the existing data into the new template without me needing to manually feed the data back in?

==/

Title: #8517064 - Pastie (at pastie.org)

holms: It looks like the uid/gid of the beaver process doesn't have read access to /var/log/syslog

losh: yeah i've see that uid/gid is set , that's cookbook fault..

anyone got this error before? Cant really find it with google

{:timestamp=>"2013-11-29T15:56:00.309000+0100", :message=>"A plugin had an unrecoverable error. Will restart this plugin.\n Plugin: <LogStash::Inputs::File type=>\"XXXX\", path=>[\"/XXX.log\"], sincedb_path=>\"/XXXX\", start_position=>\"end\">\n Error: unexpected token at 'xxx\":\"xxxxxxxxxxx\",\"url\":\"\\/xxxxxxxxxxxx\\/\",\"xx\":\"xxxxxxxxxxxxxxx\",\"http_method\":\"GET\",\"server\":\"xxxnxxxxxxxxx\",\"referrer\":\"https:\\/\\/xxxxxvxxxxxx.xxx\\/

using oldlogstahsjson codec, logs are generated by php monolog

written to file and using input file

hi guys, anyone got stuck with wrong timestamp indexing after logstash filter?

i mean, filtered events don't have the correct timestamp and are shown with the time they were filtered instead of having the timestamp they were generated by the application

Hi Mariano9, just been through this myself

take a look here http://logstash.net/docs/1.2.2/filters/date#match

Title: logstash - open source log management (at logstash.net)

pemontto: thanks, that's the source i've been using..it doesn't give me what i need

in my config the time is collected as "EventTime" from my pattern

e.g. if i have logs from an hour ago and i start the logstash filter now, the filtered events are shown with the timestamp i started the filter

from there all I needed was to add

date {

match => [ "EventTime" , "yy-MM-dd HH:mm:ss.SSS" ]

my times look like this

2013-11-23 04:55:25.946

hi all

then all you need to do is copy the format for your time string from this easy reference http://joda-time.sourceforge.net/apidocs/org/jo...

<http://tinyurl.com/mcdr8>; (at joda-time.sourceforge.net)

pemontto: that's exactly how it have configured mine

still doesn't work

I ran into a few issues where it was being ignored, mostly typos

do you have an example date string and your conf entry?

here http://pastebin.com/2KndtF86

Title: date { match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"] } - Pastebin.com (at pastebin.com)

Mariano9: can you pastebin your whole config and an example of the log you are trying to parse?

pemontto: and the log is a varnishncsa one: - - [29/Nov/2013:15:28:32 +0000] "GET ..

Mariano9: can you also pastebin your grok filter? im quessing something is wrong in there.

electrical: http://pastebin.com/n1DVCL8z

Title: grok: grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } filter - Pastebin.com (at pastebin.com)

Mariano9: do you see _grokparsefailure in your tags?