#logstash

hm, when is @timestamp generated - in input{} ?

hello, I am having trouble getting logstash 1.4.2 to pick up http.nonProxyHosts. anyone had success with this?

morning all

i have a question, more of ruby question that is

how can i get the UTC datatime of yesterday ?

from my googling ther eis like 100 ways and most are not working in a ls ruby filter

jeffr76: what do you want to achieve?

sysmonk: get the UTC date of today and yesterday

and then what?

(just curious)

sysmonk: here is what i tried before (Date.today-1).strftime('logstash-%Y.%m.%d') + ',' + Date.today.strftime('logstash-%Y.%m.%d')

sysmonk: i am rewriting the elasticsearch filter

sysmonk: adding some things we need

sysmonk: well not rewriting more like adding :)

ah you want to query the today/yesterday index

sysmonk: correct

sysmonk: can i use Activesupport ?

jeffr76: sorry i'm not the best person for ruby filter stuff

i have some ruby filters but they were mostly trial and error ones :)

sysmonk: (Time.now.utc - 86400).strftime('logstash-%Y.%m.%d') + ',' +Time.now.utc.strftime('logstash-%Y.%m.%d')

that should do it :)

another reason to always have systems in utc time :)

Hi folks.

I getting the following problem, stranger problem. I have two config files on conf.d dir, the shipper.conf and postfix.conf but when I run the daemon seems like just the shipper works, but when I run manually both works well

the both config file I've pasted here http://pastebin.com/CBNmetv6 if someone want to see something.

Title: [Ruby] logstash - Pastebin.com (at pastebin.com)

hey guys can i consult with anyone of you regarding metrics plugin ? i'm having problem reaching out the results (and sending them using graphite)

heh, looks like it's week 1 of 2015 already

and logstash been trying to put the logs in 2014.01 index (weekly index) for me, which was closed

yep, it is week 1 of 2015 according to ISO8601

yeah, created some troubles for me

as i store some indexes for 12+ months

and close the old ones down in ES

so LS can't write to them and the queues are stuck with the logs which can't be sent

solved here, permission problem.

oops

date time is hard :)

getting problems using ruby <Elasticsearch::Transport::Transport::Error: Cannot get new connection from pool.>

has anyone seen connections issues while trying to query ES

hi again, maybe soebody can advise: I have situation, when one of my log source ("squid") is not contain "program" field, another ones have it ("pf", "postfix") how I can grok only squid sourse? thanks )

another question, have "_grokparsefailure" even if there no one grok in config

ok, find it: https://groups.google.com/forum/#!topic/logstas...

<http://tinyurl.com/4kcmbx7>; (at groups.google.com)

syslog input have inbuilt grok filter

switched to tcp/udp, now its ok

syslog input needs to die :-)

electrical: agreed, but I have pfSense (FreeBSD 8.3) and there is problem to install logstash-forwarder...

tiv: i see. issue with the syslog input is that its very limited.. basically its just 3 plugins built into 1.

its far better to use the 3 plugins separately

electrical: something new everyday with logstash for newbie :)

tiv: hehe ;-)

which 3? :)

udp + ?

sysmonk: udp, tcp, grok ?? :)

ah right, i always forget about tcp for syslog :)

udp, tcp, grok, date

sorry its 4 :-)

:)

i was wondering if anyone could help me debug getting outputs to send emails? more specifically to verify its actually attempting to send the email?