[chef] Re: Re: Parsing Chef's Multiline Output


Chronological Thread 
  • From: Greg Zapp < >
  • To:
  • Subject: [chef] Re: Re: Parsing Chef's Multiline Output
  • Date: Tue, 4 Mar 2014 11:25:38 +1300

Hi Zac,

I've looked at the multi-line logstash filter's source and it appears to behave like the nxlog multi-line support;  that is the current event is "pending" until another non-matching event comes through to knock it out.  This is sub-optimal for me.  Without adding a hint of some fashion to the actual logs I can't see a way to have a multi-line event ejected as soon as it's been completed.

-Greg


On Tue, Mar 4, 2014 at 4:18 AM, Zac Stevens < " target="_blank"> > wrote:
On Sun, Mar 2, 2014 at 11:46 PM, Greg Zapp < " target="_blank"> > wrote:
I would like to know if anyone is dealing with Chef's multiline output when shipping to something like logstash->elasticsearch.  Currently Chef does not delineate log entries when they span multiple lines.  I'm considering monkey patching the logger to add a frame around the log entries but I'm not sure where the best place to do this is?  Ideally I would get it implemented before chef makes a single log entry...

When I've done this in the past, I've just used Logstash's multiline filter to collapse lines that don't begin with a datestamp in square brackets (as that's reliably at the beginning of every Chef log line).


Zac





Archive powered by MHonArc 2.6.16.

§