diff --git a/modules/openstack_project/templates/logstash/indexer.conf.erb b/modules/openstack_project/templates/logstash/indexer.conf.erb index 66b195cc33..54c200ee6a 100644 --- a/modules/openstack_project/templates/logstash/indexer.conf.erb +++ b/modules/openstack_project/templates/logstash/indexer.conf.erb @@ -4,42 +4,44 @@ input { port => 9999 format => "json" message_format => "%{event_message}" - tags => ["jenkins", "console"] - type => "jenkins_console" + type => "jenkins" } } # You can check grok patterns at http://grokdebug.herokuapp.com/ filter { grep { - type => "jenkins_console" + type => "jenkins" + tags => ["console.html"] # Drop matches. negate => true match => ["@message", "^$"] } multiline { - type => "jenkins_console" + type => "jenkins" + tags => ["console.html"] negate => true pattern => "^%{DATESTAMP} \|" what => "previous" } grok { - type => "jenkins_console" + type => "jenkins" + tags => ["console.html"] pattern => [ "^%{DATESTAMP:logdate} \| %{GREEDYDATA:logmessage}" ] add_field => [ "received_at", "%{@timestamp}" ] } date { - type => "jenkins_console" + type => "jenkins" exclude_tags => "_grokparsefailure" match => [ "logdate", "yyyy-MM-dd HH:mm:ss.SSS" ] } mutate { - type => "jenkins_console" + type => "jenkins" exclude_tags => "_grokparsefailure" replace => [ "@message", "%{logmessage}" ] } mutate { - type => "jenkins_console" + type => "jenkins" exclude_tags => "_grokparsefailure" remove => [ "logdate", "logmessage" ] }