#logstash

[vagrant@mon001 ~]$ sudo service logstash start

Starting Logstash Daemon: logstash not configured to start, please edit /etc/sysconfig/logstash to enable

zalmoxes, which puppet module? Are you getting errors?

zalmoxes: you can pass a hash config to $init_defaults with START=yes

if you're using elasticsearch/puppet-logstash

there was a little weirdness with the other defaults as i recall, but i think it was bugged and there were updates planned

spuder: i'm not getting errors, it just tries to start logstash every time

imperialwicket: thanks, i'l try that

zalmoxes: i used this http://pastebin.com/RSz52iQX

Title: exec { 'logstash conf hack': command => '/bin/sed -i "s/START=no/START=ye - Pastebin.com (at pastebin.com)

because i ran into weird errors where the jar path or bin name was missing, and it turned out a default file with just 'START=yes' wouldn't work

hm

can i have something like "different" db's for logstash?

e.g. i got 3 different sites with apache logs

and want to have them of course seperated

why not just tag them differently

yeah saw that

like log_site1, log_site2

but somethings not right

the eventview has empty spaces

doesn't the combinedapachelog take the timestamp from the logfile?

now logstash tries to launch but crashes

agh i'm missing a pattern file

Druide_ - you could output to a different elasticsearch or index. but your different sites are perfectly searchable via elasticsearch if they're in the same index

yep

i think i need to tune a big

2014/02/27 22:22:26.641901 Registrar received 1024 events

2014/02/27 22:22:28.778893 Registrar received 1024 events

2014/02/27 22:22:30.858755 Registrar received 1024 events

2014/02/27 22:22:32.900603 Registrar received 1024 events

2014/02/27 22:22:34.983670 Registrar received 1024 events

s 20

oups

whats the preferred method to run the beta 1.4 version? bin/logstash wrapper or the monolithic jar?

ryanb: no more jar

even if there is one for download

it won't be for the final release

no jar?!

no

bin/logstash -f configfile

untergeek: so it is pre-compiled and runs like elasticsearch?

it will still spawn java, as logstash is run by jruby

not compiled

it's jruby

you'll be able to browse the code and everything

only the dependent jars will be "compiled" (like the ES jar and jruby jars)

nice

ahhh

we're working out the packaging details now

heh I built the jar

I'll try out the wrapper

yeah, that won't be in the Makefile in the final 1.4 release

because 1.4 is having trouble keeping up with log volume that 1.33 was fine with

ryanb: you may be running with the regular ruby interpreter

heww

finally works

now let's get into kibana

untergeek: I'll set the jruby flag and try the wrapper, see how it goes then

go for it

does anyone refer to logstash/elasticsearch/kibana as a software stack?

like LEK

ELK is what we've been using

or ELK

LOL

vanberge: http://www.elasticsearch.org/overview/elkdownlo... for example

<http://tinyurl.com/knj5nuk>; (at www.elasticsearch.org)

oh man the elk logo possibilities are endless

yes

that is amazing

oh man there's alreayd a .01 elasticsearch

you guys seriously work toof ast

no such thing

:-)

untergeek are you a developer?

i know whack is

yes

whack and I are coworkers at elasticsearch

"developer" is a strong word

he got me hired

I'm more like a "bug writer"

haha

what are you guys' text editors of choice?

vim

chocolat

textmate

i am constantly trying to find better ones...

vim/sublime/notepad++ for indows

vim, there is no better editor!

I am waiting to try out atom

I only use vim; no other editor has the same text editing interface for me ;|

I'm hoping atom's vim stuff shapes up

would love to have a vi keyboard interface on something sanely programmable

guys, is it normal that logstash stops working after redis being unavailable and then up again?

I had to do some stuff in eclipse the other day for some android stuff... I spent 30 minutes looking for "enable vim mode" but sadly I failed... But I only had like 10 minutes of work to do so...