#logstash

j0sh^: earlier you said "I want logs so I don't want to direct them to /dev/null" but you want "all the events"

when you say "I want logs" do you mean "I want logs _somewhere_ but not in this one file"?

in which case use a different output, or different files, etc.

every event that goes through logstash, is getting logged to /var/log/logstash/server.log

its only getting logged there because you must have added an outiput to log it there

indeed

probably your daemoniser writing stdout there or sth

unless your logs are all broken and logstash is getting upset and writing out errors

you have a stdout or file output that is ending up there

doismellburning: nope ...

you've said both "I just don't want every event logged" and "I want all the events" which suggests you need to be more specific about what you actually want

hold on, lemme gist my config file

that would also be useful

if you could also think about what you actually want, and try to explain that, that would help

doismellburning:

<http://tinyurl.com/qdmykx8>; (at gist.github.com)

so I want to only log logstash errors parsing events etc in /var/log/logstash/server.conf

j0sh^: and you have no other config files in etc/config.d ?

doismellburning: nope

I did have an output to stdout, but have restart logstash_server many times since ripping out..

j0sh^: I forget the option to make logstash dump its config, but I recommend using that

ah, ok, I'll try to find out

or maybe need to stop/start expicitly ?

whatever it is, if that is really all of your config, then it sounds like you need to restart harder

lol

could it be the -vv on the command line flags when starting logstash??

sigh

that is almost certainly it yes

oh ES, why do you hate me so, everytime things will be running smooth for a while, i come in, and random shards fail to initialize and start

doismellburning: oki, thx :)

makes sense..

i'm not sure why my @timestamp field is getting populated with EPOCH time.... the pattern is matching the date properly, and the timestamp field is correct, how can I debug this?

well, not epoch time but actually the epoch (1970)

:timestamp=>"2014-10-01T10:40:11.899000-0400", :message=>"Failed to flush outgoing items", :outgoing_count=>15, :exception=>java.lang.NullPointerException, :backtrace=>[], :level=>:warn} :( imap input again....

You again!? ;)

Are you sure it's imap - that's a flush so for an output.

yeah, found logfile full of those on my indexer that is inputing the imap

seems like that post : https://groups.google.com/forum/#!msg/logstash-...

<http://tinyurl.com/4kcmbx7>; (at groups.google.com)

I cleaned my mail, wainting for one that could be the problem

herm - if you find one, can you run with --debug -- see what is on the output side of the filters

also, can you look for errors on ES side?

already running with debug since I found out. For ES where should I look?

Check the logs - it's possible ES didn't like something and kicked back

LS doesn't drop the event, so it backlogs the event

looking at the master logs should be ok or also on the data nodes ?

It may end up on whatever node LS was trying to inject the event with.

You do load your ES logs into a logging system right? (So Meta) ;)

coolacid: yes ;) a file on disk :P

just don't turn up the ES longs too far and you won't get log amplication

heh