Handle multiline Logstash events per file.
* modules/openstack_project/files/logstash/log-pusher.py: Add a filename field to logstash events that can be used to associate multiline events in files to their appropriate parents in the same file. * modules/openstack_project/templates/logstash/indexer.conf.erb: Add stream_identities to the mutliline filters that use the source host and file name to determine relationships between mutliline events. Change-Id: Ia325c0e1257131ab1b721c4df8f70f6bea1d0b99 Reviewed-on: https://review.openstack.org/30953 Reviewed-by: Jeremy Stanley <fungi@yuggoth.org> Approved: James E. Blair <corvus@inaugust.com> Reviewed-by: James E. Blair <corvus@inaugust.com> Tested-by: Jenkins
This commit is contained in:
parent
fa476974c2
commit
a388e4cc04
|
@ -32,6 +32,7 @@ filter {
|
|||
negate => true
|
||||
pattern => "^%{DATESTAMP} \|"
|
||||
what => "previous"
|
||||
stream_identity => "%{@source_host}.%{filename}"
|
||||
}
|
||||
multiline {
|
||||
type => "jenkins"
|
||||
|
@ -39,6 +40,7 @@ filter {
|
|||
negate => true
|
||||
pattern => "^%{DATESTAMP} "
|
||||
what => "previous"
|
||||
stream_identity => "%{@source_host}.%{filename}"
|
||||
}
|
||||
grok {
|
||||
type => "jenkins"
|
||||
|
|
Loading…
Reference in New Issue