openstack/openstack-ansible-ops
Code Issues Proposed changes

Use correct parsed timestamp

Browse Source 
At the moment, we're adding an extra field called "logdate" rather
than using the built-in timestamp.  This makes things go to the
right field.

Change-Id: I5e56d01692b7205418e6aba89d1c7c44fa1abfef
This commit is contained in:
Mohammed Naser 2018-09-23 17:02:19 -04:00
parent eb4e6731b5
commit 72acd46a31
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
elk_metrics_6x/templates/logstash-pipelines.yml.j2
View File

@ -183,7 +183,10 @@
"^%{CISCOTIMESTAMP:journalddate}%{SPACE}%{SYSLOGHOST:host}%{SPACE}%{SYSLOGPROG:prog}%{SPACE}%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{NUMBER:pid}%{SPACE}%{NOTSPACE:loglevel}%{SPACE}%{NOTSPACE:module}%{SPACE}%{GREEDYDATA:logmessage}"
]
}
add_field => { "received_at" => "%{@timestamp}" }
}
date {
match => [ "logdate", ISO8601 ]
remove_field => [ "logdate" ]
}
if "nova" in [tags] {
mutate {