#logstash

Hey guys, I am trying to implement rate limiting in logstash using metrics and drop filter.

filter {

metrics {

meter => "events"

add_tag => "metric"

and confirmed. The errant formats were in the vsftpd log processor I had started but wasn't using, yet. Gaaaah! Thanks again, whack.

flush_interval => 5

}

}

filter {

if "metric" in [tags] {

mutate { add_field => { "[@metadata][rate]" => "%{events.rate_1m}" } }

}

}

filter {

if [@metadata][rate] > 1000.0 {

drop { percentage => 95 }

} else if [@metadata][rate] > 600.0 {

drop { percentage => 85 }

} else if [@metadata][rate] > 300.0 {

drop { percentage => 50 }

} else if [@metadata][rate] > 80.0 {

drop { percentage => 20.0 }

} else {

drop { percentage => 0 }

}

}

looks like [@metadata][rate] > 1000.0 does not work. mismatch type ?

sounds like the rate field isn't a number?

yes. thats my guess

add_field forces things to be strings like that

you can try renaming, or using mutate's convert to turn it into a numeric type

(rename events.rate_1m to your metadata rate field, or mutate convert)

funix: next time, please use pastebin

@RoberDupont : sure .

whack: I tried convert => [ "%{[@metadata][rate]}" , "integer" ]. still does now work.

Title: logstash rate limiting - Pastebin.com (at pastebin.com)

* not

Exception in filterworker {"exception"=>#<NoMethodError: undefined method `>' for nil:NilClass>,

anyone familiar with logstash-logback-encoder?

how do i specify the syslog facility?

hmm

from the source it seems the facility is never used?

<http://tinyurl.com/pesk4x6>; (at github.com)