From 95cf542f8d5a28ae726b6864d61672982c645510 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89ric=20Lemoine?= Date: Fri, 26 Feb 2016 14:50:32 +0100 Subject: [PATCH] Fix parsing of RabbitMQ logs Currently Heka fails to parse the RabbitMQ logs. There are two problems: 1. The rabbit-sasl.log file is ignored but the file_match expression does not match. 2. The delimiter used in the RegexSplitter makes Heka stop on the very first log entry. '\n\n(=[^=]+====' (with two \n's) is a better delimiter. deliver_incomplete_final is used to get the final log entry. TrivialFix Change-Id: I94720340d5b2d6fd5d7641b9ff58733f6cd882ee --- ansible/roles/common/templates/heka-rabbitmq.toml.j2 | 7 ++++--- docker/heka/plugins/decoders/os_rabbitmq_log.lua | 2 ++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ansible/roles/common/templates/heka-rabbitmq.toml.j2 b/ansible/roles/common/templates/heka-rabbitmq.toml.j2 index 014c75113e..d8e16ec3be 100644 --- a/ansible/roles/common/templates/heka-rabbitmq.toml.j2 +++ b/ansible/roles/common/templates/heka-rabbitmq.toml.j2 @@ -4,13 +4,14 @@ filename = "lua_decoders/os_rabbitmq_log.lua" [rabbitmq_log_splitter] type = "RegexSplitter" -delimiter = '\n(=[^=]+====)' +delimiter = '\n\n(=[^=]+====)' delimiter_eol = false +deliver_incomplete_final = true [rabbitmq_logstreamer_input] type = "LogstreamerInput" decoder = "rabbitmq_log_decoder" splitter = "rabbitmq_log_splitter" log_directory = "/var/log/kolla" -file_match = 'rabbitmq/rabbit*\.log' -differentiator = ['rabbitmq'] +file_match = 'rabbitmq/(?Prabbit.*)\.log' +differentiator = ["Service"] diff --git a/docker/heka/plugins/decoders/os_rabbitmq_log.lua b/docker/heka/plugins/decoders/os_rabbitmq_log.lua index 44d2bc44fc..5ce6c65fcb 100644 --- a/docker/heka/plugins/decoders/os_rabbitmq_log.lua +++ b/docker/heka/plugins/decoders/os_rabbitmq_log.lua @@ -54,6 +54,8 @@ function process_message () msg.Timestamp = m.Timestamp msg.Payload = m.Message + msg.Logger = read_message("Logger") + if utils.label_to_severity_map[m.SeverityLabel] then msg.Severity = utils.label_to_severity_map[m.SeverityLabel] elseif m.SeverityLabel == 'CRASH' then