gschanuel

---
clusterName: "logsys"
nodeGroup: "ingest"

masterService: "logsys-master"

roles:
  master: "false"
  ingest: "true"
  data: "false"

gschanuel

---
clusterName: "logsys"
nodeGroup: "master"

masterService: ""

roles:
  master: "true"
  ingest: "false"
  data: "false"

gschanuel

---
clusterName: "logsys"
nodeGroup: "data"

masterService: "logsys-master"

roles:
  master: "false"
  ingest: "false"
  data: "true"

gschanuel

[     7.206] (--) Log file renamed from "/var/log/Xorg.pid-7628.log" to "/var/log/Xorg.0.log"
[     7.207] 
X.Org X Server 1.20.13
X Protocol Version 11, Revision 0
[     7.207] Build Operating System: Linux Archlinux
[     7.207] Current Operating System: Linux air 5.13.9-arch1-1 #1 SMP PREEMPT Sun, 08 Aug 2021 11:25:35 +0000 x86_64
[     7.207] Kernel command line: BOOT_IMAGE=/vmlinuz-linux root=UUID=1e616a3c-93fd-44eb-9b86-411e89eb551e rw quiet splash resume=UUID=11117c72-4498-4388-b1d3-10d179608507
[     7.207] Build Date: 04 August 2021  08:13:54AM
[     7.207]  
[     7.207] Current version of pixman: 0.40.0

gschanuel

---
clusterName: "logsys"
nodeGroup: "ingest"

masterService: "logsys-master"

roles:
  - ingest
  - ml

gschanuel

-- Journal begins at Sun 2021-06-06 18:32:59 -03, ends at Mon 2021-06-28 12:48:53 -03. --
Jun 28 05:11:48 FC735754 kernel: Linux version 5.12.12-arch1-1 (linux@archlinux) (gcc (GCC) 11.1.0, GNU ld (GNU Binutils) 2.36.1) #1 SMP PREEMPT Fri, 18 Jun 2021 21:59:22 +0000
Jun 28 05:11:48 FC735754 kernel: Command line: BOOT_IMAGE=/vmlinuz-linux root=UUID=321e1804-c1ba-4755-8993-56bda2461362 rw loglevel=3 quiet
Jun 28 05:11:48 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Jun 28 05:11:48 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Jun 28 05:11:48 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Jun 28 05:11:48 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
Jun 28 05:11:48 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
Jun 28 05:11:48 FC735754 kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Jun 28 05:11:48 FC735754 kernel: x86/fpu: xstate_offset[3]:  83

gschanuel

-- Journal begins at Sun 2021-06-06 18:32:59 -03, ends at Mon 2021-06-28 12:48:53 -03. --
Jun 28 04:25:42 FC735754 kernel: Linux version 5.12.12-arch1-1 (linux@archlinux) (gcc (GCC) 11.1.0, GNU ld (GNU Binutils) 2.36.1) #1 SMP PREEMPT Fri, 18 Jun 2021 21:59:22 +0000
Jun 28 04:25:42 FC735754 kernel: Command line: BOOT_IMAGE=/vmlinuz-linux root=UUID=321e1804-c1ba-4755-8993-56bda2461362 rw loglevel=3 quiet
Jun 28 04:25:42 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
Jun 28 04:25:42 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
Jun 28 04:25:42 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
Jun 28 04:25:42 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
Jun 28 04:25:42 FC735754 kernel: x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
Jun 28 04:25:42 FC735754 kernel: x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
Jun 28 04:25:42 FC735754 kernel: x86/fpu: xstate_offset[3]:  83

gschanuel

FROM alpine:edge

RUN apk add --no-cache \
      chromium \
      nss \
      freetype \
      harfbuzz \
      ca-certificates \
      ttf-freefont \
      nodejs \

gschanuel

[2021-05-26T17:33:04,465][WARN ][logstash.outputs.elasticsearch][main][849150c28dbf9ddd8eb487458ee01bbae035cb14ff8fd0d15192c9cf83f0ed82] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"azure-2021.05-20", :routing=>nil}, #<LogStash::Event:0x60f379bc>], :response=>{"index"=>{"_index"=>"azure-2021.05-20", "_type"=>"_doc", "_id"=>"eqm8qXkBEEt1iLZzqlgN", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse field [event.code] of type [long] in document with id 'eqm8qXkBEEt1iLZzqlgN'. Preview of field's value: 'SharePoint'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: \"SharePoint\""}}}}}
[2021-05-26T17:33:04,465][WARN ][logstash.outputs.elasticsearch][main][849150c28dbf9ddd8eb487458ee01bbae035cb14ff8fd0d15192c9cf83f0ed82] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"azure-2021.05-20", :routing=>nil}, #<LogStash::Event:0x54f6c771>], :response=>{"in

gschanuel

input {
	beats {
		port => "5244"
		tags => "o365"
		client_inactivity_timeout => 86400
	}
}
filter {
	geoip {
		source => "[client][ip]"