openstack/logstash-filters
Code Issues Proposed changes

Handle 'ERROR' for multiline oslofmt

Browse Source 
oslo.log commit 27f7fe52fefcb81c5fe01736841d7a20149caf02 changed the
"logging_exception_prefix" config option to use the ERROR rather than
TRACE level which breaks multi-line queries in logstash.o.o, which is
kind of a big deal for elastic-recheck to not have super generic
queries.

This makes the log level an OR for TRACE or ERROR for versions of
oslo.log used in stable branches and ERROR for master.

This should behave OK otherwise because of the %{NUMBER} in the pattern
where NUMBER corresponds to the pid in logging_exception_prefix:

  %(asctime)s.%(msecs)03d %(process)d ERROR %(name)s %(instance)s

Closes-Bug: #1474545

Change-Id: Iddd7f51b6a57deb6d56fc9f702992e7b14cf5cde
This commit is contained in:
Matt Riedemann 2015-07-14 14:03:46 -07:00
parent 9ea0ba8e6c
commit 8556df1a4b
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
indexer.conf.erb
View File

@ -37,7 +37,9 @@ filter {
}
multiline {
negate => false
pattern => "^%{TIMESTAMP_ISO8601}%{SPACE}%{NUMBER}?%{SPACE}?TRACE"
# NOTE(mriedem): oslo.log 1.2.0 changed the logging_exception_prefix
# config option from using TRACE to ERROR so we have to handle both.
pattern => "^%{TIMESTAMP_ISO8601}%{SPACE}%{NUMBER}?%{SPACE}?(TRACE|ERROR)"
what => "previous"
stream_identity => "%{host}.%{filename}"
}