| input { | |
| exec { | |
| type => 'proc-stat' | |
| exec => 'cat /proc/stat' | |
| period => 5 | |
| } | |
| exec { | |
| type => 'free' | |
| exec => 'free' | |
| period => 8 |
| source :rubygems | |
| gem "logstash", :git => "git://github.com/logstash/logstash.git" |
| #!/usr/bin/env bash | |
| ruby_version="1.9.2-p180" | |
| rpm_version="0.2" | |
| [[ -s "$HOME/.rvm/scripts/rvm" ]] && . "$HOME/.rvm/scripts/rvm" # Load RVM function | |
| #make sure we have rvm | |
| no_rvm=$(which rvm | grep 'no rvm') | |
| if [ "$no_rvm" ] ; then | |
| echo "install rvm" |
| log_level :info | |
| log_location STDOUT | |
| ssl_verify_mode :verify_none | |
| chef_server_url "http://localhost:4000" | |
| signing_ca_path "/var/chef/ca" | |
| couchdb_database 'chef' | |
| cookbook_path [ "/var/chef/cookbooks", "/var/chef/site-cookbooks" ] | |
| input { | |
| exec { | |
| command => "cat /proc/stat" | |
| interval => 10 | |
| type => "cpu" | |
| } | |
| # stdin { | |
| # type => "cpu" | |
| # } | |
| } |
I've seen alot of discussion on the user-list about logstash and the river feature of elasticsearch.
This is how I index my events from logstash. All of my events come into logstash via amqp with the routing event.raw.. Once Logstash processes them it outputs them back to amqp with the routing key event.processed.. I then have this worker that gets all "processed" messages and sets them up for elasticsearch to recieve. It them shoves them back up with routing key event.indexed..
| curl -XPUT es:9200/_template/logstash -d ' | |
| { | |
| "template" : "logs-*", | |
| "settings" : { | |
| "index" : { | |
| "analysis" : { | |
| "analyzer" : { | |
| "default" : { | |
| "type" : "simple" | |
| } |
| IOError: Connection reset by peer | |
| sysread at org/jruby/ext/openssl/SSLSocket.java:583 | |
| fill_rbuff at jar:file:/opt/logstash/server/lib/logstash-1.1.6.dev.jar!/META-INF/jruby.home/lib/ruby/1.9/openssl/buffering.rb:53 | |
| read at jar:file:/opt/logstash/server/lib/logstash-1.1.6.dev.jar!/META-INF/jruby.home/lib/ruby/1.9/openssl/buffering.rb:94 | |
| read at jar:file:/opt/logstash/server/lib/logstash-1.1.6.dev.jar!/gems/jls-lumberjack-0.0.6/lib/lumberjack/server.rb:127 | |
| each_event at jar:file:/opt/logstash/server/lib/logstash-1.1.6.dev.jar!/gems/jls-lumberjack-0.0.6/lib/lumberjack/server.rb:72 | |
| run at jar:file:/opt/logstash/server/lib/logstash-1.1.6.dev.jar!/gems/jls-lumberjack-0.0.6/lib/lumberjack/server.rb:64 | |
| run at jar:file:/opt/logstash/server/lib/logstash-1.1.6.dev.jar!/gems/jls-lumberjack-0.0.6/lib/lumberjack/server.rb:49 | |
| Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (SystemExit) Connection reset by peer | |
| at org.jruby.RubyThread.join(org/jruby/Ruby |
| #Goal is to print \[%{HTTPDATE\] from an array, so the final string will look like: ["\[%{HTTPDATE}\]"] | |
| puts "\[%{HTTPDATE}\]" | |
| puts '\[%{HTTPDATE}\]' | |
| puts "\\[%{HTTPDATE}\\]" | |
| puts '\\[%{HTTPDATE}\\]' | |
| puts ["\[%{HTTPDATE\]"].inspect | |
| puts ["\[%{HTTPDATE\]"].to_s | |
| puts ["\\[%{HTTPDATE\\]"].inspect | |
| puts ["\\[%{HTTPDATE\\]"].to_s |
| % JRUBY_OPTS= bin/logstash agent -e ' | |
| input { | |
| generator { type => foo } | |
| } | |
| filter { | |
| metrics { meter => "events" add_tag => ["metric"] } | |
| } |