driskell / log-courier

The Log Courier Suite is a set of lightweight tools created to ship and process log files speedily and securely, with low resource usage, to Elasticsearch or Logstash instances.
Other
419 stars 107 forks source link

Configuration error: Option /files/[0]/codec is not available #346

Closed vikashb72 closed 8 years ago

vikashb72 commented 8 years ago

I can't seem to get log-courier to startup

head version: 1c170f60f06d4a979c603e8dcd98f95a008566ae

built:

set GO15VENDOREXPERIMENT=1
go get -d github.com/driskell/log-courier
cd %GOPATH%/src/github.com/driskell/log-courier
go generate ./lc-lib/config ./lc-lib/core
go install . ./lc-admin ./lc-tlscert

Error:

$GOPATH/bin/log-courier --config /usr/local/etc/log-courier.conf
Configuration error: Option /files/[0]/codec is not available

$GOPATH/bin/log-courier -list-supported
Available transports:
  tcp
  tls
Available codecs:
  filter
  multiline
  plain

config:

{
  "general": {
    "log level" : "debug",
    "persist directory": "/var/lib/log-courier"
  },
  "network": {
    "transport": "tcp",
    "servers": [ "172.16.254.4:5140" ]
  },
  "files": [ {
    "paths": [ "/var/log/radacct/*/detail-????????" ],
    "fields": {
      "type": "radiusdetail"
    },
    "codec": {
      "name": "multiline",
      "pattern": "^[A-Z\t]",
      "negate": false,
      "what": "next"
    },
    "dead time": "12h"
  } ]
}

please advise

driskell commented 8 years ago

You can now specify multiple codecs in version 2 so you'll need to update your configuration. See: https://github.com/driskell/log-courier/blob/master/docs/Configuration.md#codecs

Also, the multiline codec in version 2 removes negate and allows multiple patterns, and each pattern can be negated individually using a prefix of !. See: https://github.com/driskell/log-courier/blob/master/docs/codecs/Multiline.md

You'll want to change your "codec" bit to something like:

    "codecs": [{
      "name": "multiline",
      "patterns": ["^[A-Z\t]"],
      "what": "next"
    }],
vikashb72 commented 8 years ago

Thank you Should have spent more time reading your docs than following tl;dr blogs

driskell commented 8 years ago

No problem 👍