From c7ae1e3a5e92d46a5137bf191564c9c165d8512c Mon Sep 17 00:00:00 2001 From: pcrews Date: Sat, 2 Aug 2014 12:57:34 -0700 Subject: [PATCH] Enhancing logstash docs for adding new files Adding some extra verbiage to the docs to better explain how the message tags tie in to telling logstash how to parse things. Also noting which file to edit when adding new files, how to add new parsing patterns, and some troubleshooting tips. Change-Id: Ie91effd4b3ff3627ec040eb5c54b972e82add0e7 --- doc/source/logstash.rst | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/doc/source/logstash.rst b/doc/source/logstash.rst index 5af5b835fb..6431877572 100644 --- a/doc/source/logstash.rst +++ b/doc/source/logstash.rst @@ -165,6 +165,22 @@ The config file that tells Logstash how to do this flattening can be found at :file:`modules/openstack_project/templates/logstash/indexer.conf.erb` +This works via the tags that are associated with a given message. + +The tags in +:file:`modules/openstack_project/templates/logstash/indexer.conf.erb` +are used to tell logstash how to parse a given file's messages, based +on the file's message format. + +When adding a new file to be indexed to +:file:`modules/openstack_project/files/logstash/jenkins-log-client.yaml` +at least one tag from the indexer.conf.erb file should be associated +with the new file. One can expect to see '{%logmessage%}' instead of +actual message data if indexing is not working properly. + +In the event a new file's format is not covered, a patch for +:file:`modules/openstack_project/templates/logstash/indexer.conf.erb` +should be submitted with an appropriate parsing pattern. ElasticSearch -------------