Grep filter not excluding message—help?

[rta...@twitter.com]

Hi,

I'm pretty new to fluentd/td-agent.  I'm trying to configure a grep filter to exclude some messages.  My config looks like this:

<source>

  @include gnip_wrapper_log.include

  path /opt/gnip/replayerator/logs/wrapper.log

  pos_file /var/log/td-agent/replayerator_wrapper.log.pos

</source>

<filter gnip.opt.gnip.replayerator.logs.wrapper.log>

  @type grep

  exclude1 message GC

</filter>

<match gnip.opt.gnip.replayerator.logs.wrapper.log>

  @include gnip_s3.include

  buffer_path /var/log/td-agent/buffer/opt/gnip/replayerator/logs/wrapper/

  s3_object_key_format "%{path}/%{time_slice}/wrapper.log.%{index}.%{file_extension}"

</match>

I'm trying to exclude messages like this:

2016-03-24T21:14:39Z	gnip.opt.gnip.replayerator.logs.wrapper.log	{"level":"INFO","process":"jvm 1","message":"5609.748: [GC [PSYoungGen: 2668288K->81856K(2691584K)] 5762318K->3176051K(8284160K), 0.0221580 secs] [Times: user=0.13 sys=0.00, real=0.02 secs] "}

But for some reason the filter isn't excluding those.

Can anyone spot what I'm doing wrong?

[Naotoshi Seo]

It looks grep filter is working well.

fluent.conf

  <source>

    @type dummy

    tag gnip.opt.gnip.replayerator.logs.wrapper.log

    dummy [{"level":"INFO","process":"jvm 1","message":"5609.748: [GC [PSYoungGen: 2668288K->81856K(2691584K)] 5762318K->3176051K(8284160K), 0.0221580 secs] [Times: user=0.13 sys=0.00, real=0.02 secs] "},{"level":"INFO","process":"jvm 1","message":"foo"}]

  </source>

  <filter gnip.opt.gnip.replayerator.logs.wrapper.log>

    @type grep

    exclude1 message GC

  </filter>

  <match gnip.opt.gnip.replayerator.logs.wrapper.log>

    @type stdout

  </match>

$ bundle exec fluentd -c fluent.conf

2016-03-25 16:02:19 +0900 gnip.opt.gnip.replayerator.logs.wrapper.log: {"level":"INFO","process":"jvm 1","message":"foo"}

2016-03-25 16:02:21 +0900 gnip.opt.gnip.replayerator.logs.wrapper.log: {"level":"INFO","process":"jvm 1","message":"foo"}

Regards,

Naotoshi a.k.a. sonots

--
You received this message because you are subscribed to the Google Groups "Fluentd Google Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to fluentd+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.