[Thu Jan 25 12:07:44.355300 2024] [mpm_event:trace1] [pid 1633595:tid 140648225171200] event.c(1573): All workers are busy or dying, will close 0 keep-alive connections
Apache2 config to enable this logLogLevel warn mpm_event:trace8
or in the general case, regardless of which plugins you use
LogLevel trace1
Problem Cause
The problem is caused by usage of this LOGLEVEL definition from grok-patterns
Possible solution
These patterns work, instead of modifying LOGLEVEL, I have added a new copy with a new name, to avoid changing others usage of LOGLEVEL
Logstash information:
I'm using Logstash 8.2.3, but problematic grok-pattern is still in master as seen here: https://github.com/logstash-plugins/logstash-patterns-core/blob/main/patterns/ecs-v1/httpd
Log example (from apache2)
Apache2 config to enable this log
LogLevel warn mpm_event:trace8
or in the general case, regardless of which plugins you useLogLevel trace1
Problem Cause The problem is caused by usage of this LOGLEVEL definition from grok-patterns
Possible solution These patterns work, instead of modifying LOGLEVEL, I have added a new copy with a new name, to avoid changing others usage of LOGLEVEL
Above patterns work when tested in https://grokconstructor.appspot.com/do/match#result