From 23e70213f25aa1cd742304d68b4b96615b610974 Mon Sep 17 00:00:00 2001 From: Matt Riedemann Date: Tue, 14 Jul 2015 14:03:46 -0700 Subject: [PATCH] Handle 'ERROR' for multiline oslofmt oslo.log commit 27f7fe52fefcb81c5fe01736841d7a20149caf02 changed the "logging_exception_prefix" config option to use the ERROR rather than TRACE level which breaks multi-line queries in logstash.o.o, which is kind of a big deal for elastic-recheck to not have super generic queries. This makes the log level an OR for TRACE or ERROR for versions of oslo.log used in stable branches and ERROR for master. This should behave OK otherwise because of the %{NUMBER} in the pattern where NUMBER corresponds to the pid in logging_exception_prefix: %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s Closes-Bug: #1474545 Change-Id: Iddd7f51b6a57deb6d56fc9f702992e7b14cf5cde --- modules/openstack_project/templates/logstash/indexer.conf.erb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/openstack_project/templates/logstash/indexer.conf.erb b/modules/openstack_project/templates/logstash/indexer.conf.erb index b9d0260e8c..d18cef39b2 100644 --- a/modules/openstack_project/templates/logstash/indexer.conf.erb +++ b/modules/openstack_project/templates/logstash/indexer.conf.erb @@ -37,7 +37,9 @@ filter { } multiline { negate => false - pattern => "^%{TIMESTAMP_ISO8601}%{SPACE}%{NUMBER}?%{SPACE}?TRACE" + # NOTE(mriedem): oslo.log 1.2.0 changed the logging_exception_prefix + # config option from using TRACE to ERROR so we have to handle both. + pattern => "^%{TIMESTAMP_ISO8601}%{SPACE}%{NUMBER}?%{SPACE}?(TRACE|ERROR)" what => "previous" stream_identity => "%{host}.%{filename}" }