Fix parsing of RabbitMQ logs

Currently Heka fails to parse the RabbitMQ logs. There are two
problems:

1. The rabbit-sasl.log file is ignored but the file_match expression
   does not match.
2. The delimiter used in the RegexSplitter makes Heka stop on the
   very first log entry. '\n\n(=[^=]+====' (with two \n's) is
   a better delimiter. deliver_incomplete_final is used to get the
   final log entry.

TrivialFix

Change-Id: I94720340d5b2d6fd5d7641b9ff58733f6cd882ee
This commit is contained in:
Éric Lemoine 2016-02-26 14:50:32 +01:00
parent 287e4faf99
commit 95cf542f8d
2 changed files with 6 additions and 3 deletions

View File

@ -4,13 +4,14 @@ filename = "lua_decoders/os_rabbitmq_log.lua"
[rabbitmq_log_splitter]
type = "RegexSplitter"
delimiter = '\n(=[^=]+====)'
delimiter = '\n\n(=[^=]+====)'
delimiter_eol = false
deliver_incomplete_final = true
[rabbitmq_logstreamer_input]
type = "LogstreamerInput"
decoder = "rabbitmq_log_decoder"
splitter = "rabbitmq_log_splitter"
log_directory = "/var/log/kolla"
file_match = 'rabbitmq/rabbit*\.log'
differentiator = ['rabbitmq']
file_match = 'rabbitmq/(?P<Service>rabbit.*)\.log'
differentiator = ["Service"]

View File

@ -54,6 +54,8 @@ function process_message ()
msg.Timestamp = m.Timestamp
msg.Payload = m.Message
msg.Logger = read_message("Logger")
if utils.label_to_severity_map[m.SeverityLabel] then
msg.Severity = utils.label_to_severity_map[m.SeverityLabel]
elseif m.SeverityLabel == 'CRASH' then