Changing time formatting display

[Gerhardus Geldenhuis]

Hi

I am trying to configure our riemann server to display a more human readable version of time than the unix number in the pagerduty alert. Unfortunately the people that configured riemann here has left and did not do a lot of internal docs.

Currently we have this in config for pagerduty:

Extracted from:/etc/riemann/riemann.config

(defn pagerduty-format

  "Nice formatting for PagerDuty format"

  [event]

  (let [[short_host subdomain _] (str/split (if (:fqdn event) (:fqdn event) (str/join "." (reverse (str/split (:host event) #"\.")))) #"\." 3)]

    (merge

      (riemann.pagerduty/format-event-v2

        (merge

          event

          (if-let [has-time (:time event)]

            {:time (long has-time)}

            {})))

      {

        :summary (str (:service event)

                      " at "

                      (:host event)

                      " is "

                      (:state event)

                      " ("

                      (:metric event)

                      ")")

        :group subdomain

        :severity (condp = (:state event)

          "ok"       "info"

          "warning"  "warning"

          "critical" "critical"

                     "error")

        :custom_details (assoc event :graphs

          (str

           "http://grafana." subdomain ".company.com/?var-aggregate=Yes"

           "&var-site=" subdomain "&var-host=" short_host ))})))

I thought that if I changed {:time (long has-time)} to {:time (unix-to-iso8601((long has-time))} that it would display a more appropriate format in pagerduty.

However I am not convinced riemann likes the config file. If I restart rieman on the centos 7.6 machine it restarts but does not show any error in journalctl or in the log file. I added some random brackets just to definitely break the config and still no complaint from the daemon.

I also tried replacing the long function directly with unix-to-iso8601 and tried time-at function both as a replacement for the long function and as a wrapper for the result of the long function.

So I have two problems:

• I can't test the config and the riemann service does not seem to test it either or report it broken
• Can't get the formating of the output to be what I desire

So I am clearly not an expert on clojure, I did in my defence at least read the primer http://riemann.io/clojure.html which allowed me to make changes which I thought would work. 

So any pointers of help would be greatly appreciated.

Regards

[Sanel Zukan]

Hi,

You don't change ':time', because it is used to generate ':timestamp' in
event. Try to adjust or add ':timestamp' in the last map, e.g.

{:summary...
:group ...
:timestamp <-- custom format
}

or with existing code:

(merge
(riemann.pagerduty/format-event-v2
...)
{:summary ...
:group ...
...
:custom_details...
}
;; added code
(when (:time event)
{:timestamp (unix-to-iso8601 (:time event))}))

Best,
Sanel

> - I can't test the config and the riemann service does not seem to test

> it either or report it broken

> - Can't get the formating of the output to be what I desire

>
>
> So I am clearly not an expert on clojure, I did in my defence at least read
> the primer http://riemann.io/clojure.html which allowed me to make changes
> which I thought would work.
>
> So any pointers of help would be greatly appreciated.
>
> Regards
>

> --
> You received this message because you are subscribed to the Google Groups "Riemann Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to riemann-user...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/riemann-users/86776c2d-4763-499b-9cf4-11a4ad793750n%40googlegroups.com.

[Toby McLaughlin]

For the testing problem, try running Riemann outside of systemd, with:

riemann test /etc/riemann/riemann.config

and

riemann start /etc/riemann/riemann.config

Cheers,

Toby.