Closed jslusher closed 8 years ago
I'm trying to use this plugin in combination with the grok format plugin to parse elasticsearch slowlogs. I have the following configuration:
<source> @type dummy dummy {"log":"[2016-08-21 18:02:29,649][WARN ][index.search.slowlog.fetch] [logstash-2016.08.21]took[3s], took_millis[3080], types[], stats[], search_type[QUERY_AND_FETCH], total_shards[1], source[{\"size\":500,\"sort\":[{\"@timestamp\":{\"order\":\"desc\",\"unmapped_type\":\"boolean\"}}],\"query\":{\"filtered\":{\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"@timestamp\":{\"gte\":1471801647542,\"lte\":1471802547542,\"format\":\"epoch_millis\"}}}],\"must_not\":[]}}}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"require_field_match\":false,\"fragment_size\":2147483647},\"aggs\":{\"2\":{\"date_histogram\":{\"field\":\"@timestamp\",\"interval\":\"30s\",\"time_zone\":\"America/Chicago\",\"min_doc_count\":0,\"extended_bounds\":{\"min\":1471801647541,\"max\":1471802547542}}}},\"fields\":[\"*\",\"_source\"],\"script_fields\":{},\"fielddata_fields\":[\"@timestamp\"]}], extra_source[], \n","stream":"stdout","time":"2016-08-21T18:02:29.650016637Z"} tag dummy-data </source> <filter dummy-data> @type parser format grok <grok> grok_pattern %{ESINDEXSEARCHSLOWLOGS} custom_pattern_path /opt/fluentd/grok-patterns </grok> key_name log </filter> <match dummy-data> type stdout </match>
...
I see this in the output from fluentd: [warn]: parse failed undefined methodparse' for #`
[warn]: parse failed undefined method
It's the error which grok parser raised, not this plugin.
You are correct. Thanks for responding!
I'm trying to use this plugin in combination with the grok format plugin to parse elasticsearch slowlogs. I have the following configuration:
...
I see this in the output from fluentd:`
[warn]: parse failed undefined method
parse' for #