#logstash

hey, i created a certificate for logstash and forwarder which worked

now with file beat i get: transport.go:125: ERR SSL client failed to connect with: x509: certificate signed by unknown authority

where can i find a openssl syntax to create a valid one?

I got it to work Friday with letsencrypt cert on logstash side but I had to distribute the chained CA to all filebeat clients.

^^ sol_

<---

help! =)

I'll pay it forward as soon as I get over my own speedbump. Almost there (I hope)

hmm but there you need to request one

i would like to create one with openssl if possible

I think it will be involved: You need to make a CA, sign both the server and client's certs with it, and distribute the CA cert to clients.

rastro_: I'm totally set! Thank you.

UNIX timestamps to the rescue

DanGarthwaite: weird on the T, but glad you got it working.

I'm a python guy. This ruby through java is a world of hurt. :)

hello, somebody can help me please,,, kv filter can convert string to integer?

kv cannot, you need to use mutate

warkolm: is there a minimum jruby version i need to work w/ plugins?

what do you mean by "work with plugins", work how

warkolm: sorry, i need to build a gem for the elasticsearch output plugin from master

it contains a fix thats not in the main distro yet (afaik)

oh, dunno on that sorry. I'll ask the devs though

thanks!

>= jruby-1.7.20

thanks!

but apparently there was issues before .23 so better to use latest

"rvm/rbenv make the upgrade and the managing easy"

warkolm: that was my exact plan, so thanks

qq, is there something wrong with the UDP input? it seems to die and I've tried adding the logstash user to the root group and such

if the syslog input works the same way, that one still works on the same ports, should I just use that?

any advice?

datajunkie: syslog is different because I think it expects a specific format

syslog might get you grok parse failure

where udp doesn't

ah, anything I should check as to why the udp listener keeps dying? it was working prior to 2.x

oh nvm it seems to work now... I might have magically fixed it

the only thing I can think of is looking in the opened/closed bugs if there is a solution

or workaround

maybe I just had to talk seductively to it

could you talk seductively to my logstash too ;)

possibly, but I charge by the quarter hour

;)

thanks for the help anywho

976-DUPONT

I wrote up php -> json -> logstash: http://garthwaite.org/php-json-logging-to-logst...

Thanks again rastro_

irc auto reconnect and username still in use ...

Bossi: right. didn't notice until i read DanGarthwaite's blog :)

just correct it with "/NICK <nickname>" unless you use an already by someone else registered nick

rastro: That your twitter handle?

DanGarthwaite: nope

Anyone taken a multiline field (such as a java exception) and pulled out just the first line as a separate field?

im somewhat unfamiliar with the logstash build system, we've built a newer version of the ES output plugin from master, and it seems we are getting the following: https://gist.github.com/anonymous/7e8b8516c0385...

nvm, google turned up a possible fix