#logstash

I use lumberjack to set the "type" field, and then do:

if [type] == "foo" {

} else if [type] == "bar" {

}

it *seems* to be pretty fast

the config looks like one of whack's baby's diapers, to be honest.

but it's fast

avleen: ok. Sound like you aren't all that thrilled.

my apache access logs are 50% of my total log volume, so that [type] is matched first

I could just dream of an #include file with regexps in it that I could HUP logstash to re-read

it's not great, but I can't think of a better way yet. *yet*. I'm sure there is one :)

that would be awesome

i would love that

One can dream...

I have this recollection of hearing about this,but that may be riemann I recall handling config changes on the fly

Ok, so maybe I'll pester Jordan some time about how handles (what I have to guess is a common) this case.

right now I suffer the restarts, in theory a HUP would be possible, but I imagine there is some complexity to getting it done. Eg, you'd want to parse the config for syntax errors etc to make sure you're not loading a bad config

avleen: there are kind of two ickys for me, the restart and the creation of a massive config file that has 30, 50, whatever, lines of grep or drop filter info inline.

i don't find it too bad myself. my biggest gripe is that it looks "messy" because json is so damn verbose with the syntax.

avleen: and everything on the sending side buffers for you, so the server going bye-bye isn't a problem, right?

also I would be way more upset if lumberjack^Wlogstash-forwarder didn't handle the reconnects well when i restart logstash. you *do* end up with a thundering herd problem tho - everything hits the first server that comes back. I'm adding in a fix for that soon. maybe next week if I have time.

yup

^^ :)

what sort of fix, randomize the destination or add a random pause on return?

reconnect every N seconds (where N is a command line option)

to a random host

that makes sense

I think it's fairly sane. maybe with an exponential backoff to reconnect, of failure

*on failure

so if you get a connection refused, pause 1s, 2s, 4s, 8s, etc

right

ok, bed time

have a good night

night!

hi, i followed the cookbook http://cookbook.logstash.net/recipes/apache-jso... but only the log file is created but with no json data in it please help

<http://tinyurl.com/c5wmjt2>; (at cookbook.logstash.net)

hello

can i use sphinx with logstash?

hai

i need tutorial install and configure logstash the easiest one

awan2: for beginners this will help http://logstash.net/docs/1.2.2/tutorials/gettin...

<http://tinyurl.com/kg4mxv7>; (at logstash.net)

thank you so much this what i looking for