add horizon_error to the indexed logs

this adds horizon_error to the indexed log files, which is very
useful in determining how horizon fails, as we get very specific
stack traces.

Change-Id: Ifb323e327dbc2931100a4552d029d91209c4bbba
This commit is contained in:
Sean Dague 2014-03-14 16:21:10 -04:00 committed by Clark Boylan
parent f9da1187d5
commit ae96d3bf6c
2 changed files with 19 additions and 1 deletions

View File

@ -154,6 +154,9 @@ source-files:
tags:
- screen
- oslofmt
- name: logs/horizon_error.txt
tags:
- apacheerror
# TODO(clarkb) Add swift proxy logs here.
- name: logs/syslog.txt
tags:

View File

@ -72,6 +72,11 @@ filter {
add_field => { "logdate" => "%{timestamp}" }
add_field => { "logmessage" => "%{verb} %{request} %{response}" }
}
} else if "apacheerror" in [tags] {
grok {
match => { "message" => "\[(?<logdate>%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}%{SPACE}%{TZ}?)\]%{SPACE}\[%{LOGLEVEL:loglevel}\]%{SPACE}%{GREEDYDATA:logmessage}" }
add_field => { "received_at" => "%{@timestamp}" }
}
} else if "libvirtd" in [tags] {
grok {
# libvirtd grok filter adapted from
@ -96,7 +101,17 @@ filter {
if ! ("_grokparsefailure" in [tags]) {
date {
match => [ "logdate", "yyyy-MM-dd HH:mm:ss.SSS", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "dd/MMM/yyyy:HH:mm:ss Z", "yyyy-MM-dd HH:mm:ss.SSSZ" ]
match => [ "logdate",
"yyyy-MM-dd HH:mm:ss.SSS",
"yyyy-MM-dd HH:mm:ss,SSS",
"yyyy-MM-dd HH:mm:ss",
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"dd/MMM/yyyy:HH:mm:ss Z",
"yyyy-MM-dd HH:mm:ss.SSSZ",
"E MMM dd HH:mm:ss yyyy Z",
"E MMM dd HH:mm:ss yyyy"
]
timezone => "UTC"
}
mutate {