logstash-users Google Group

is logtash able to follow a log-file after its' rotation?

ksubins...@gmail.com (subin) — Thu, 20 Jun 2013 10:17:38 UT

hi,
I'm planning to use Logstash as a *log-shipper* also on many of the
servers.
So I'm wondering if Logstash is able to follow up the data on a log file
after
it gets rotated? Will there be any data-loss in practical situations? I'm
not
using COPYTRUNCATE for logrotation.
Please advise.
Thanks,

Re: [logstash-users] GeoIP config prevents tartup

j...@semicomplete.com (Jordan Sissel) — Thu, 20 Jun 2013 02:46:04 UT

This is a known bug with logstash on Windows. It'll be fixed in the next
release. Sorry about that! :)

-Jordan

GeoIP config prevents tartup

mdragi...@gmail.com (Innocent Bystander) — Thu, 20 Jun 2013 02:28:22 UT

OS: Windows 2008R2
Logstash Version: 1.1.13
Java Version: jdk1.7.0_21 (64 bit)
Logstash directory: c:\Logstash
Startup params: "%JAVA_HOME%\bin\java.exe" -Xmx128M -jar
logstash-1.1.13-flatjar.jar agent --config logstash.conf --log logstash.log
-v
Adding this to the filter config prevents logstash from starting up:

Re: [logstash-users] {:timestamp=>"2013-06-19T14:16:24.582000-0400", :message=>"No HOME environment variable set, I don't know where to keep track of the files I'm watching. Either set HOME in your environment, or set sincedb_path in in your logstash config for the file

j...@semicomplete.com (Jordan Sissel) — Wed, 19 Jun 2013 19:09:27 UT

This error means logstash doesn't know where to store it's database of what
files it's watching. By default, it will try to save the file in $HOME/
somewhere, but if that value is not set, logstash has no default location
it can pick to write to, which means you need to provide it.

You can fix this one of two ways:

Re: [logstash-users] Re: gsub a field for statsd output, but not send to elasticsearch

bly...@yahoo.com (Bruce) — Wed, 19 Jun 2013 18:25:22 UT

Of course all of this isn't necessary. I re-read the statsd output
documentation today:
sender

- Value type is string<[link]>
- Default value is "%{@source_host}"
The name of the sender. Dots will be replaced with underscores

{:timestamp=>"2013-06-19T14:16:24.582000-0400", :message=>"No HOME environment variable set, I don't know where to keep track of the files I'm watching. Either set HOME in your environment, or set sincedb_path in in your logstash config for the file

jobsforpr...@gmail.com — Wed, 19 Jun 2013 18:23:56 UT

Hi anybody having idea why i am getting this error

Re: [logstash-users] LogStash on HP-UNIX ?

j...@semicomplete.com (Jordan Sissel) — Wed, 19 Jun 2013 17:05:29 UT

I guess not :(

I don't have any local way to test on HP-UX, so I don't expect support to
improve in the near future unfortunately.
I'd love for someone to help out with this! :)

-Jordan

LogStash on HP-UNIX ?

kaush...@gmail.com — Wed, 19 Jun 2013 14:05:24 UT

Hi All,
I tried out the logstash 1.1.10 on HP-UX, but it gives the following error
on startup :
*Exception in thread "main" org.jruby.exceptions.RaiseExce ption:
(LoadError) Unsupported platform: unknown-unknown*
at org.jruby.RubyKernel.require(o rg/jruby/RubyKernel.java:1027)
at
RUBY.require(jar:file:/smapp/l ogstash/bin/logstash-1.1.10-mo nolithic.jar!/META-INF/jruby.h ome/lib/ruby/shared/rubygems/c ustom_require.rb:36)

Re: [logstash-users] Minimum logging for logstash agent on client servers

kaush...@gmail.com — Wed, 19 Jun 2013 14:03:25 UT

Ohk - guess I have to use logrotate
Thanks for the reply :)

Re: [logstash-users] Log rotation

kaush...@gmail.com — Wed, 19 Jun 2013 14:03:01 UT

Hmmm sounds good
Thanks :)

Re: [logstash-users] Re: Question for experienced DevOps people

radu.gheor...@sematext.com (Radu Gheorghe) — Wed, 19 Jun 2013 12:39:00 UT

Hi Igor,

That link is about templates, which is about how rsyslog formats logs for
passing them on, not parsing the logs it gets.

For what it's worth, those templates got a bit more human in the 7.x
versions:
[link]

But your statement is still correct (IMO), because if your logs are not

Re: Question for experienced DevOps people

serdar.o...@gmail.com — Wed, 19 Jun 2013 12:07:13 UT

Hi,

I guess there is no shipper library for .net c#. I am planning write one of
if it is not a big deal. Could you give me information like How it
iscommunicate, What protocol is used etc. İf is there a documentation it
will be great.

Receive an error: Either set HOME in your environment, or set sincedb_path in in your logstash config for the file

cksjac...@gmail.com (Jacky Chu) — Wed, 19 Jun 2013 07:42:19 UT

Hi,
I would like to ask if someone receive following message if run the
logstash startup script instead of running java command from the console in
shipper server.
{:timestamp=>"2013-06-19T15:29 :49.225000+0800", :message=>"No HOME
environment variable set, I don't know where to keep track of the files I'm

Re: Json parsing and statsd

smaine.kahlo...@gmail.com — Wed, 19 Jun 2013 07:28:51 UT

Hi all !
Do you have any idea on how to manage json input and get graph on graphite
please ?
I think it's just a matter of configuration, isn't it ?
Thanks,
Smana

Re: Question for experienced DevOps people

krylt...@gmail.com (Igor Kryltsov) — Wed, 19 Jun 2013 07:20:37 UT

Hi Radu & Jordan,
Thanks for sharing.
So
[link] much more complex syntax to parse logs than adding logstash in between
rsyslog and elasticsearch?
you?
Agree. [link] let's put syslog-ng