From 2f2169bc56460d71353b4b0256a420c42d791710 Mon Sep 17 00:00:00 2001
From: Clark Boylan <clark.boylan@gmail.com>
Date: Thu, 13 Jun 2013 14:38:44 -0700
Subject: [PATCH] Handle mutliline oslofmt traceback in logstash.

* modules/openstack_project/templates/logstash/indexer.conf.erb: Add a
mutliline filter that matches oslo format TRACE level log lines. This
will collect all lines related to the traceback in a single event.

Change-Id: I201e407b6bd6fbb5b2db94fa6757f184709f2eaa
Reviewed-on: https://review.openstack.org/32962
Reviewed-by: James E. Blair <corvus@inaugust.com>
Reviewed-by: Khai Do <zaro0508@gmail.com>
Approved: Clark Boylan <clark.boylan@gmail.com>
Reviewed-by: Clark Boylan <clark.boylan@gmail.com>
Tested-by: Jenkins
---
 indexer.conf.erb | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/indexer.conf.erb b/indexer.conf.erb
index 7b7f874..14b7686 100644
--- a/indexer.conf.erb
+++ b/indexer.conf.erb
@@ -50,6 +50,14 @@ filter {
     what => "previous"
     stream_identity => "%{@source_host}.%{filename}"
   }
+  multiline {
+    type => "jenkins"
+    tags => ["oslofmt"]
+    negate => false
+    pattern => "^%{DATESTAMP}%{SPACE}%{NUMBER}?%{SPACE}?TRACE"
+    what => "previous"
+    stream_identity => "%{@source_host}.%{filename}"
+  }
   multiline {
     type => "jenkins"
     tags => ["keystonefmt"]