how to solve the error

[Shahina Shaik]

Error: uninitialized constant Fluent::Plugin::RegexpParser

[Shahina Shaik]

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-parser' version '0.6.1'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-ping-message' version '0.2.0'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-rewrite-tag-filter' version '1.5.5'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-s3' version '1.0.0.rc2'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-scribe' version '0.10.14'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-tail-ex' version '0.1.1'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-td' version '0.10.28'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-td-monitoring' version '0.2.2'

2017-02-08 14:13:03 +0530 [info]: gem 'fluent-plugin-webhdfs' version '0.4.2'

2017-02-08 14:13:03 +0530 [info]: gem 'fluentd' version '0.14.12'

2017-02-08 14:13:03 +0530 [info]: gem 'fluentd' version '0.12.26'

2017-02-08 14:13:03 +0530 [warn]: #0 'type' is deprecated parameter name. use '@type' instead.

2017-02-08 14:13:03 +0530 [info]: adding match pattern="tomcat.logs" type="elasticsearch"

2017-02-08 14:13:03 +0530 [warn]: #0 'type' is deprecated parameter name. use '@type' instead.

2017-02-08 14:13:03 +0530 [info]: adding source type="tail"

2017-02-08 14:13:03 +0530 [error]: #0 config error file="td-agent.conf_log" error_class=Fluent::ConfigError error="Invalid regexp '^(?<datetime>[0-9]{2}-[A-Za-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}) (?<Log-Level>[A-Z]*) (?<message>.*)$': uninitialized constant Fluent::Plugin::RegexpParser"

2017-02-08 14:13:03 +0530 [info]: Worker 0 finished unexpectedly with status 2

2017-02-08 14:13:03 +0530 [info]: Received graceful stop

[root@sgplstackelk1 td-agent]# 

[Mr. Fiber]

Please write more information.

We are not psychic ;)

Masahiro

On Wed, Feb 8, 2017 at 5:57 PM, Shahina Shaik <sssh...@gmail.com> wrote:

Error: uninitialized constant Fluent::Plugin::RegexpParser

--
You received this message because you are subscribed to the Google Groups "Fluentd Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fluentd+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Mr. Fiber]

conf file?

--

[Mr. Fiber]

I tried your regexp with in_tail and it worked.

So I need your actual conf file.

2017-02-08 18:36:42 +0900 [info]: using configuration file: <ROOT>
  <source>
    @type tail
    path "/Users/repeatedly/tmp/fluentd/test_tail.log"
    tag "tail.test"
    format /^(?<datetime>[0-9]{2}-[A-Za-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}) (?<Log-Level>[A-Z]*) (?<message>.*)$/
    <parse>
      @type regexp
      expression ^(?<datetime>[0-9]{2}-[A-Za-z]{3}-[0-9]{4} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}) (?<Log-Level>[A-Z]*) (?<message>.*)$
    </parse>
  </source>
  <match tail.**>
    @type stdout
  </match>
</ROOT>
2017-02-08 18:36:42 +0900 [info]: #0 starting fluentd worker pid=5010 ppid=4982 worker=0

[Shahina Shaik]

<source>

@type tail

path /tmp/access_log-20170205

pos_file /tmp/grock1

<parse>

@type grok

grok_pattern %{IP:ip_address}

</parse>

tag grokked_log

</source>

<match grokked_log>

@type elasticsearch

logstash_format false

host 192.168.1.36 #(optional; default="localhost")

port 9200 #(optional; default=9200)

index_name grok1 #(optional; default=fluentd)

type_name log #(optional; default=fluentd)

</match>

error getting is:-

2017-02-09 11:14:31 +0530 [error]: #0  error_class=NameError error="uninitialized constant Fluent::Plugin::RegexpParser"

i need to use grok pattern instead you use regular expression

 

[Shahina Shaik]

my log file

vi access_log-20170205

192.168.0.204 - - [02/Feb/2017:16:45:34 +0530] "GET /browserconfig.xml HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko"

192.168.0.204 - - [02/Feb/2017:17:47:01 +0530] "GET /browserconfig.xml HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko"

[Mr. Fiber]

It seems the bug of fluent-plugin-grok-parser.

Could you report it on grok-parser repository?

[okimoto]

Hi,

I've released new version of fluent-plugin-grok-parser.
Try it, please.

https://rubygems.org/gems/fluent-plugin-grok-parser

2017年2月9日木曜日 15時43分28秒 UTC+9 repeatedly:

It seems the bug of fluent-plugin-grok-parser.

Could you report it on grok-parser repository?

On Thu, Feb 9, 2017 at 3:08 PM, Shahina Shaik <sssh...@gmail.com> wrote:

my log file

vi access_log-20170205

192.168.0.204 - - [02/Feb/2017:16:45:34 +0530] "GET /browserconfig.xml HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko"

192.168.0.204 - - [02/Feb/2017:17:47:01 +0530] "GET /browserconfig.xml HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko"

--
You received this message because you are subscribed to the Google Groups "Fluentd Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to fluentd+u...@googlegroups.com.

[Shahina Shaik]

<source>

  @type tail

  path /tmp/grok210

  pos_file /tmp/hhhh

  tag grokked_log

  <parse>

    @type grok

    grok_pattern %{IP:ip_address}

  </parse>

</source>

<match grokked_log>

@type stdout

</match>

used fluent-plugin-grok-parser --version 2.1.2

not getting any error and also no output

[Mr. Fiber]

How about removing previous pos_file and add `read_from_head true`?

--
You received this message because you are subscribed to the Google Groups "Fluentd Google Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to fluentd+unsubscribe@googlegroups.com.

[Shahina Shaik]

Done!!!

got the output...

Thank you!!!

[Mr. Fiber]

Check FAQ of plugin for more detail: http://docs.fluentd.org/v0.12/articles/in_tail#faq

[Shahina Shaik]

On Wednesday, February 8, 2017 at 2:27:12 PM UTC+5:30, Shahina Shaik wrote:

[Shahina Shaik]

[Shahina Shaik]

# Get events from CloudTrail

<source>

  @type cloudtrail

  sqs_url https://sqs.ap-south-1.amazonaws.com/xxxxxxxxxxxx/sqs-organtrail

  role_arn arn:aws:sqs:ap-south-1:xxxxxxxxxx:sqs-organtrail

  tag cloudtrail

</source>

<filter cloudtrail>

  @type grep

  regexp1 eventSource ^signin\.amazonaws\.com$

</filter>

<match cloudtrail>

    @type stdout

</match>

getting this error:-

2017-02-10 14:40:59 +0530 [info]: gem 'fluent-plugin-webhdfs' version '1.1.0'

2017-02-10 14:40:59 +0530 [info]: gem 'fluent-plugin-webhdfs' version '0.4.2'

2017-02-10 14:40:59 +0530 [info]: gem 'fluentd' version '0.14.12'

2017-02-10 14:40:59 +0530 [info]: gem 'fluentd' version '0.12.26'

2017-02-10 14:40:59 +0530 [info]: adding filter pattern="cloudtrail" type="grep"

2017-02-10 14:40:59 +0530 [info]: adding match pattern="cloudtrail" type="stdout"

^C2017-02-10 14:40:59 +0530 [info]: Received graceful stop

2017-02-10 14:40:59 +0530 [info]: adding source type="cloudtrail"

2017-02-10 14:40:59 +0530 [error]: #0 unexpected error error_class=NameError error="uninitialized constant Fluent::Input"

  2017-02-10 14:40:59 +0530 [error]: #0 /opt/td-agent/embedded/lib/ruby/gems/2.1.0/gems/fluent-plugin-cloudtrail-0.0.2/lib/fluent/plugin/in_cloudtrail.rb:8:in `<module:Fluent>'

  2017-02-10 14:40:59 +0530 [error]: #0 /opt/td-agent/embedded/lib/ruby/gems/2.1.0/gems/fluent-plugin-cloudtrail-0.0.2/lib/fluent/plugin/in_cloudtrail.rb:6:in `<top (required)>'

  2017-02-10 14:40:59 +0530 [error]: #0 /opt/td-agent/embedded/lib/ruby/site_ruby/2.1.0/rubygems/core_ext/kernel_require.rb:121:in `require'

how to overcome this above error which is highlighted in red color