Closed sramak1396c closed 9 years ago
I removed remove_prefix and it worked. Thanks a lot.
I get the same message when I try to use the parser pluging
2015-02-06 10:50:28 +0100 [warn]: parse failed undefined local variable or method `raw_value' for #<Fluent::ParserOutput:0x007f2385e00f60>
config:
<source>
type forward
port 24224
bind 0.0.0.0
</source>
<match raw.la.cs.exc.as>
type parser
format multiline
format_firstline /^\d{4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2},\d{3}/
format1 /^(?<time>\d{4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}),(?<msec>\d{3})\s\[(?<thread>[^\]]*)\] \[(?<user>[^\]]*)\]\s(?<level>[^\s]\w*)\s(?<caller>[^\s]*)\s-\s(?<full_message>.*)/
time_format %Y-%m-%d %H:%M:%S
remove_prefix raw
key_name message
</match>
I want to use the plugin in the collector before (it receives from several forwarders the logs) and parse them before I send them further.
The parsing works if I do it as part of in_tail but I would prefer to do it centralized.
Any suggestions what I might do wrong? The answer above refers to "remove_prefix" but this or add_prefix is mandatory (besides that I would like to use it).
Thx in advance
@antofran22 It's bug! #21 I'll fix it later.
Does this plugin needs a specific version of ruby? Here is my config source> type syslog port 24224 bind 0.0.0.0 protocol_type tcp tag system log_level debug <match system.local2.**> type parser remove_prefix raw format apache key_name message
Fails with 014-11-18 21:09:18 +0000 [warn]: parse failed undefined local variable or method
raw_value' for #<Fluent::ParserOutput:0x00000001d3cb78> 2014-11-18 21:09:18 +0000 fluent.warn: {"message":"parse failed undefined local variable or method
raw_value' for #Fluent::ParserOutput:0x00000001d3cb78"}My ruby version is 2.1.2p95 . does this plugin require a specific ruby version?