logstash-config: how to configure patterns

[greg0ire]

I can't figure out how to use the confd patterns key.

Is it supposed to work yet? It is not documented ATM.

I noticed that the patterns template uses config keys that do not have the /self/service/metadata part like in the config template.

I tried configuring rancher like this :

logstash:
  metadata:
    logstash:
      patterns:
        - ${indexer_patterns}

and like this:

logstash:
  metadata:
    logstash:
      patterns:
        - |
          ${indexer_patterns}

But the patterns file stays empty… @cloudnautique, maybe you can help?

[mojogitoverhere]

Your rancher-compose files are correct. Like you said, the problem is the keys in the logstash confd config template are wrong. The PR to fix it has been open since May 2016 but still hasn't been merged https://github.com/rancher/catalog-dockerfiles/pull/65.

[0ff]

For the time being (until #65 is merged) you could use our patched image in rancher to restore functionality: simpletechs/rancher_logstash-config:v0.2.0-smpl1. The only change is the fixed patterns.tmpl.

You can then use the patterns like this:

logstash-indexer:
    metadata:
      logstash: &id002
        filters: |-
          grok {
            patterns_dir => ["/opt/logstash/patterns"]
            match => [
              "message", "%{TEST}"
              ]
            }
        patterns:
          test: |-
            TEST ...

[greg0ire]

Thanks a lot, that's very helpful, but I found a workaround in the meantime (not using patterns_dir IIRC)