#logstash

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

its ubuntu, and "This account is currently not available"

sudo su logstash

or sudo -iu logstash /bin/bash

sorry, there was a stray -i

so sudo -u logstash /path/to/logstash -f /path/to/config ....

it just wont find the configs despite the -f /etc/logstash

which configs?

you might need to pass more than this parameter, just have a peek at what logstash offers.

if you have a really trivial pipeline config, -e might be an option as well

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

actually everything is on default

but it just wont startup and run with your above command

as I said, you might need to pass some more parameters.

[WARN ] 2018-08-02 11:01:24.910 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified

ok, so yes, that looks as expected.

see https://www.elastic.co/guide/en/logstash/6.3/ru... for a list of all command line options

here it is: [2018-08-02T11:06:19,822][DEBUG][logstash.pipeline ] filter received {"event"=>{"message"=>"2018-08-02T11:06:19,721127873+02:00\nwhatever;foo;bar\n", "@timestamp"=>2018-08-02T09:06:19.722Z, "type"=>"random_number", "host"=>"tibyke-H81M-DS2V", "@version"=>"1", "command"=>"/tmp/logstash_exec"}}

ok, so that looks good

so now figure out why it doesn't get sent to ES

maybe there's a filter that only sends events of a certain type

or you can't write it to the index because you have a type conflict in the index

but what actually the script output look like? json? csv? plain text? key-value pairs? I just dont get it

if there's an error on the ES side and the document can't be indexed, then you should see an error in the logstash and the es logs

should+

that looks like the script prints the timestamp, then a newline, then "whatever;foo;bar" followed by another newline

yes, indeed

well, is that what the script prints when you run it on the command line?

yes, thats fine

ok, then I don't understand the question.

what would be the next step? filter should process it, and pass it to output ES, right?

the next step is just as with any other kind of input: process it according to your requirements, send it to one or multiple outputs.

and how would that above output would go to ES by default? what format?

i just dont get it

there is literally nothing special about the above output

it would go to ES like anything else

it's a document that contains the scripts output in the field "message" and some metadata in the other fields

this is the document that would be sent to ES:

{"message"=>"2018-08-02T11:06:19,721127873+02:00\nwhatever;foo;bar\n", "@timestamp"=>2018-08-02T09:06:19.722Z, "type"=>"random_number", "host"=>"tibyke-H81M-DS2V", "@version"=>"1", "command"=>"/tmp/logstash_exec"}

ah, okay, i got it, I had a bloody IF in the output :D

told you.

and as I can see there is a command key there, so I can rely on that when filtering/transforming the message, right?

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

yes

okay, all clear, thanks!

now im trying with some json input + the json filter

okay, so its all fine now, thanks again

this is actually pretty cool =:)

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

Read what IRC investigative journalists have uncovered on the freenode pedophilia scandal https://encyclopediadramatica.rs/Freenodegate

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

Read what IRC investigative journalists have uncovered on the freenode pedophilia scandal https://encyclopediadramatica.rs/Freenodegate

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

Read what IRC investigative journalists have uncovered on the freenode pedophilia scandal https://encyclopediadramatica.rs/Freenodegate

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

Read what IRC investigative journalists have uncovered on the freenode pedophilia scandal https://encyclopediadramatica.rs/Freenodegate

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

I thought you guys might be interested in this blog by freenode staff member Bryan 'kloeri' Ostergaard https://bryanostergaard.com/

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/

With our IRC ad service you can reach a global audience of entrepreneurs and fentanyl addicts with extraordinary engagement rates! https://williampitcock.com/