#logstash

tigryss: Hogy vagy

Hi all! I was wondering if logstash would be a good choice to centralize multiline logs for scheduled jobs from a number of servers.

Hi everyone. I'm trying to developping a filter for logstash but I've got troubles running it. I have packaged it as a gem, I can install it with plugin install <path to the gem> and logstash tell me everything is ok. But when I try to run a dummy configuration with my plugin, logstash can't found it. It's not listed by 'plugin list' too. What can I try next ?

Hello!

hola

I have little problem with syslog and grok - grok is adding tag "_grokparsefailure_syslog".. :-( Have you ever got this?

_grokparsefailure_syslog means it can't process your input proper

the grok definition seems not to match

hi que: 2 many work for today

jwd, I agree with that, but grok parse correctly when I put message to stdin

tigryss: i get it. Work hard go pro ;)

in debbuger it work great too, so I think that filter rule is OK

maybe there are extra info you not see in the pure message?

Hi everyone. I'm trying to developping a filter for logstash but I've got troubles running it. I have packaged it as a gem, I can install it with plugin install <path to the gem> and logstash tell me everything is ok. But when I try to run a dummy configuration with my plugin, logstash can't found it. It's not listed by 'plugin list' too. What can I try next ?

que your right, but i need to work in CGI in 2015.... no comment

jwd I think about it, but I dont know hot check it - any suggestions?

can you see the raw messages coming into the system?

jwd, I have line from rsyslog log file - is it sufficient for check?

should be

but the entry that shown the parse failure should have the info to

brb. need to head to the DC.

ok

here is sample log line: http://pastebin.com/FiyYKL42

Title: Jul 22 15:15:29 host.name INFO 22 Jul 2015 15:15:29,736 org.glite.ce.creamapi.jo - Pastebin.com (at pastebin.com)

and here is my filter rules: https://discuss.elastic.co/t/-grokparsefailure-...

<http://tinyurl.com/o8jb7l7>; (at discuss.elastic.co)

is it normal for kibana4 to be this slow on an i3?

any visualization i try takes minutes to render

rpetre, have you check load on machine?

it's my workstation, the browser caps the cpu

the server is fine

whats mean that "your browser caps the cpu"? :P

i mean the browser uses 100% cpu while it tries to render the visualization, and takes a few minutes

oh, I get it now.. what browser do you use?

firefox (well, iceweasel)

version? I haven't any problems on 39.0

it's 31.7 (extended support release)

i wanted to know if it's some known performance issue with angular (or k4 in particular)

on a newer computer/browser it's relatively ok, but i'm worried about perf issues since i plan to show kibana on some embedded computers on various tvs around the office

hellos

i'm getting this error :

/(?<a0>(?<a1>([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)): (?<a2>.*?)[src=(?<a3>.*?)[tcp:\/\/{(?<a4>.*?)}:.*; sent=(?<a5>(?<a6>(?>\d\d){1,2})\/(?<a7>(?:0?[1-9]|1[0-2]))\/(?<a8>(?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]))[-, ]+(?<a9>(?!<[0-9])(?<a10>(?:2[0123]|[01]?[0-9]))

and i dont get wher ein my regex is wrong :(

rpetre, maybe problem is hardware acceleration? try turn it off/on

finbit what you try to do?

im trying to parse a log file from tomcat

in this case localhost log file

send me sample log line :)

FINbit_: suomalainen ?

que ? wot ?

nothing nothing

whatever that language is

p

your nick is missleading

im not finnish :p

i figure that out already.

why ? its just a tcp flag bit :p

but its funny coz u aint the first person making that assumption

hehehe

says the polish guy who doesn't speak spanish, but is called que

:D

Rumbles: life is funny