#logstash

ode This is your game ? http://www.desura.com/games/aeon-ball

Title: Aeon Ball Windows, Mac, Linux game | Desura (at www.desura.com)

Hello

Hi, I have custom grok patterns file. where should I put it in order to make it available to logstash conf files?

logstash is unpacked from tar.gz, NOT package install

found it, in grok plugin configuration there's a setting 'patterns_dir'

anyone willing to help someone new logstash?

best to just ask if you have questions

k, getting grok parse error on this line (trying to parse dns log file) "3/29/2015 3:58:10 PM 053C PACKET 00000018E4743FD0 UDP Snd 8.8.8.8 cf28 Q [0001 D NOERROR] AAAA (4)akak(3)com(0)"

putting conf file up, just a sec

Title: input { tcp { codec => json {charset => "CP1252"} port => 2121 tags = - Pastebin.com (at pastebin.com)

pattern checks out in grok debugger, but I'm new to logstash conf files. tagging the input as grokparsefailure

have you run it through the config using stdout to make sure it works?

are there other config files you are using?

just that config file, no not yet, just been working with the debugger, will look up how to do that (new sorry)

just the stdout output

stdout { codec => rubdebug }

that's close to the format that ES uses, it's handy for troubleshooting

k changing that, and testing

hi

why logstash can read only 500msg per second?

and eat a cpu core

from redis channel

500 msg it is big or not?

it's reasonable, depends on what your node is doing

you could break it up so that indexing is done with different nodes on the back, and break your messages up on the ingress

put a rabbitmq or redis between the two and you may get your message rate up

@warkolm: getting couldn't find any codec plugin named 'rubdebug'

typo, that's why. it's rubydebug

ah k

kalloc: we can bench over 2k using a variation on this setup