#logstash

hi, does anyone know about correct mapping for geo_points?

double-p_ just for ref, my truststore issue is an ubuntu bug https://bugs.launchpad.net/ubuntu/+source/ca-ce...

<http://tinyurl.com/ouoyuho>; (at bugs.launchpad.net)

is it possible to make errors in an output simply stall the queue, instead of dropping events?

I'm trying to configure my logstash worker so that if elasticsearch is down, it blocks until it's back, and eventually stops consuming from the inputs (Redis). It seems to just drop events instead though...

Is this blocking queue-like behaviour not how logstash is supposed to work? Am I missing something here?

it should block rather than drop

Its my understanding that any output queue failure will block all output queues, then filter queues, then input queues

^^^ ++

robodwyer: "errors in an output simply stall the queue" is the behavior of logstash.

whack: interesting. I have a pretty simple setup with a Redis list input, Elasticsearch output, and when I took down elasticsearch the Redis list did not appear to fill up.

there was a ton of errors in the logstash logs though (more than the default queue size of 20), so I assumed it had lost them. I'll have to double-check.

sbfox1: would having a lot of filters increase the overall buffer? i.e. more events would have to pile up before the input would block?

I *think* the buffers of each pipeline are relatively small, 20-30 events iirc

Hey, where in the "event" schema is the tags? i.e. if I want to add a tag inside a "ruby" block how to do I do it? I know how to add a field event["fieldname"] = "field_value" but not sure how to do tags. I throught maybe it'd be something like event["tags"].push("newtag") but that doesn't seem to work.

I sorry guys, but i just installed logstash and run -e with basic input/output ( like on the website) but i don't see anything back as i type. Any hints for me ? thx

racar: do you have elasticsearch running? is anything being indexed?

Nevermind. Got it... OF COURSE their is a tag method. :P

stormpython: i don't want using elasticsearch at the moment. Just want to test it. ( yes i want to use ELK, but not yet )

i just run : bin/logstash -e 'input { stdin { } } output { stdout {} }'

racar: ok

thats interesting because it ran for me, which system are you running on

perhaps you could check the logs

i tried on linux mint and ubuntu 14.04

the log are empty , im running directly in command line with "-e"

whack: only 3 blockers left before 1.5? :)

racar: how long do you wait for a response, mine seems to take some time

at least for the first one

hahah you'Re right.

damn, i feel stupid ;P

racar: cool

thx

np

avleen: yep! Hoping we get RC1 out the door this week; we'll see.

the team's doing an awesome job shaving yaks to finish up some things

I'm busy focusing on lsf 0.4.0 which may come soon also

i saw! this is really cool. very excited.

oooooooooo anything fun in there?

nothing fun in lsf

hehe

I am experimenting with disabling TLS because, for lack of better phrasing, fucking tired of people asking for it