Merge "add horizon_error to the indexed logs"

This commit is contained in:
Jenkins 2014-03-18 14:12:01 +00:00 committed by Gerrit Code Review
commit ba5c418935
2 changed files with 19 additions and 1 deletions

View File

@ -154,6 +154,9 @@ source-files:
tags:
- screen
- oslofmt
- name: logs/horizon_error.txt
tags:
- apacheerror
# TODO(clarkb) Add swift proxy logs here.
- name: logs/syslog.txt
tags:

View File

@ -72,6 +72,11 @@ filter {
add_field => { "logdate" => "%{timestamp}" }
add_field => { "logmessage" => "%{verb} %{request} %{response}" }
}
} else if "apacheerror" in [tags] {
grok {
match => { "message" => "\[(?<logdate>%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}%{SPACE}%{TZ}?)\]%{SPACE}\[%{LOGLEVEL:loglevel}\]%{SPACE}%{GREEDYDATA:logmessage}" }
add_field => { "received_at" => "%{@timestamp}" }
}
} else if "libvirtd" in [tags] {
grok {
# libvirtd grok filter adapted from
@ -96,7 +101,17 @@ filter {
if ! ("_grokparsefailure" in [tags]) {
date {
match => [ "logdate", "yyyy-MM-dd HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "dd/MMM/yyyy:HH:mm:ss Z", "yyyy-MM-dd HH:mm:ss.SSSZ" ]
match => [ "logdate",
"yyyy-MM-dd HH:mm:ss.SSS",
"yyyy-MM-dd HH:mm:ss,SSS",
"yyyy-MM-dd HH:mm:ss",
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"dd/MMM/yyyy:HH:mm:ss Z",
"yyyy-MM-dd HH:mm:ss.SSSZ",
"E MMM dd HH:mm:ss yyyy Z",
"E MMM dd HH:mm:ss yyyy"
]
timezone => "UTC"
}
mutate {