elasticsearch - Logstash is not converting correctly in JSON -

-

following json log file

[     {         "error_message": " failed line input file (end of file?).",          "type": "error",          "line_no": "2625",          "file": "gtfplaintext.c",          "time": "17:40:02",          "date": "01/07/16",          "error_code": "gtf-00014"     },      {         "error_message": " bad gtf plain text file header or footer line. ",          "type": "error",          "line_no": "2669",          "file": "gtfplaintext.c",          "time": "17:40:02",          "date": "01/07/16",          "error_code": "gtf-00004"     },      {         "error_message": " '???' ",          "type": "error",          "line_no": "2670",          "file": "gtfplaintext.c",          "time": "17:40:02",          "date": "01/07/16",          "error_code": "gtf-00005"     },      {         "error_message": " failed find 'event source'/'product detail' records event source '3025188506' host event type 1 valid",          "type": "error",          "line_no": "0671",          "file": "rguide.cc",          "time": "15:43:48",          "date": "06/07/16",          "error_code": "rguide-00033"     } ]

according understanding log in json, not need filter section in logstash configuration. following logstash config

input {   file{     path => "/home/ishan/sf_shared/log_json.json"     start_position => "beginning"     codec => "json"   } }

and output configuration is

output {   elasticsearch {     hosts => ["localhost:9200"]     sniffing => true     manage_template => false     index => "%{[@metadata][beat]}-%{+yyyy.mm.dd}"     document_type => "%{[@metadata][type]}"   }   stdout { codec => rubydebug } }

but seems data not going es, not able see data when query index. missing?

i think problem json codec expects full json message on 1 line , won't work message on multiple lines.

a possible work around use multiline codex , use json filter.
configuration multiline codec be:

multiline {   pattern => "]"   negate => "true"   => "next" }

all lines not begin ] regrouped next line, you'll have 1 full json document give json filter.


Comments

Post a Comment

Popular posts from this blog

sql - invalid in the select list because it is not contained in either an aggregate function -

-
i can't figure out rewrite sql statement avoid error below msg 8120, level 16, state 1, line 26 column 'staffmember.staffmemberid' invalid in select list because not contained in either aggregate function or group clause. sql statment select (select [dbo].[udf_readstaffmemberbasic](sm.staffmemberid) xml path ('staffmembersummary'), root ('items'), type ), count(sm.staffmemberid) totalresults, ceiling(cast(count(sm.staffmemberid) decimal)/ @pagesize) totalpages staffmember sm inner join staffmembertoadditionalrole ar on sm.staffmemberid = ar.staffmemberid (sm.firstname '%' + @name + '%' or sm.surname '%' + @name + '%') , (@floorid null or sm.floorid = @floorid) , (@directorateid null or sm.directorateid = @directorateid) , (@additionalroleid null or ar.additionalroleid = @additionalroleid) order sm.staffmemberid offset @page * @pagesize rows fe...
Read more

Angularjs unit testing - ng-disabled not working when adding text to textarea -

-
i trying test angularjs component using karma, mocha, power-assert. have textarea , button in component, button disabled based on length of text in textarea. when run component in browser works perfectly. can't figure out how test functionality. here's bit of code. inquiryform.js function inquiryform($scope) { // plan add logic here } angular.module('myapp').component('inquiryform', { controller: inquiryform, controlleras: 'inquiryform', templateurl: 'inquiryform.html' }); inquiryform.html <div class="contact"> <div>thanks contacting us.</div> <form> <textarea ng-model="inquiryform.inquirytext" name=""></textarea> <input type="submit" value="send" ng-disabled="!inquiryform.inquirytext.length"> </form> </div> inquiryformtest.js describe('inquiry form ', () => { let $r...
Read more

How to start daemon on android by adb -

-
can me please, head swollen... i trying run daemon on android emu/device command: adb -s <device_name> shell su -c /dir/daemon <port_number> but nothink happens, , no errors! if do: adb -s <device> shell and form shell cmdline: su -c /dir/daemon <port_number> than work fine. try use shell-script , run: adb -s <device_name> shell sh su -c /dir/script.sh <port_number> and try generate script qt code port number , use: adb -s <device_name> shell sh su -c /dir/script.sh but not helped... problem if enter adb shell previous run daemon - work. problem on different device/emu/iso_image different command format not work. example: adb -s <device_name> shell su -c /dir/daemon <port_number> // work @ emu, not @ iso and vice: adb -s <device_name> shell su -c "/dir/daemon <port_number>" // work @ iso etc. everybody can answer what's matter? sorry english adb shell su -c ...
Read more