Logstash filter to annotate Riak error messages

[hectcastro]

Basho recently added a listing of common Riak error messages [0] you may encounter running Riak in production. This project [1] is an attempt at using that listing to annotate error logs with more detailed descriptions and resolutions via a Logstash filter.

Example error message:

2013-03-29 16:29:34.322 [info] <0.58.0> alarm_handler: {set,{system_memory_high_watermark,[]}}

Example of that message after it goes through Logstash and the riak_errors filter:

{
  "@source": "file://basho.local/Users/tsantero/monitorama/riak-1.3.0/dev/dev4/log/console.log",
  "@tags": [ ],
  "description": "Often a sign than an ETS table has grown too large."
  "resolution": "Check that you are using a backend appropriate for your needs (LevelDB for very large key counts), that your vnode count is reasonable (measured in dozens per node rather than hundreds)."
  "@timestamp": "2013-03-29T20:29:36.891Z",
  "@source_host": "basho.local",
  "@source_path": "/Users/tsantero/monitorama/riak-1.3.0/dev/dev4/log/console.log",
  "@message": "2013-03-29 16:29:34.322 [info] <0.58.0> alarm_handler: {set,{system_memory_high_watermark,[]}}",
  "@type": "dev4"
}

[0] http://docs.basho.com/riak/latest/references/Errors/ [1] https://github.com/hectcastro/logstash/blob/riak_errors/lib/logstash/filters/riak_errors.rb

[jordansissel]

+1