-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Good question.
I am still not sure how to split streams. Now I can parse the access log from the output from the json decoder, but can't pass these same messages into the nginx error module. Any ideas? On 06/10/15 11:06, Christian Kniep wrote: > Hey y'all, > > on that topic ‘kinda replacing Logstash’. > > I am not mistaken it’s possible to chain multiple steps together as > one would do in logstash, correct? I use the [ProcStatDecoder] and > pass it in a couple of steps towards the [LogOutput] by stating the > previous step in the ‘message_type’. As far as I understood it (or > hope it works) it will parse all the config and afterwards create > the correct workflow based on the matcher and name of the steps. > > Cheers Christian > > > -- > > > > Christian Kniep | Release Engineer > > www.gaikai.com <http://www.gaikai.com/> > >> On 06 Oct 2015, at 10:32, Robert Gardam >> <[email protected] >> <mailto:[email protected]>> wrote: >> >> I managed to get it to work. I think the only way to make this >> work is to use the multi-decoder as I still need all other syslog >> messages to be processed in heka and passed onto es. >> >> >> On 05/10/15 22:58, Rob Miller wrote: >>> On 10/5/15 9:59 AM, Robert Gardam wrote: >>>> Hi All, I'm just trying out moving from logstash and I'm >>>> wondering how does one push one message from one decoder into >>>> another decoder after it has been decoded the first time. >>>> >>>> Essentially i'm decoding json rsyslog messages from a tcp >>>> input and then I want to pass only one field into the nginx >>>> access log decoder. >>> Most of the work for the nginx access decoder is done in a >>> module, so I'd recommend just copying the nginx decoder code >>> and adding your JSON parsing right in the same decoder. >>>> I can multi decode, but this only seems to decode json first >>>> but not pass the json message into the second decoder. >>> MultiDecoder should work, albeit less efficiently. You have to >>> set `cascade_strategy = "all"` (the default is "first-wins") >>> for your use case, though; did you set that? >>> >>> -r >>> >>> _______________________________________________ Heka mailing >>> list [email protected] <mailto:[email protected]> >>> https://mail.mozilla.org/listinfo/heka >> >> -- Robert Gardam DevOps Engineer Native Instruments GmbH >> +49-30-611035-1775 >> >> www.native-instruments.com <http://www.native-instruments.com> >> _______________________________________________ Heka mailing >> list [email protected] https://mail.mozilla.org/listinfo/heka > - -- Robert Gardam DevOps Engineer Native Instruments GmbH +49-30-611035-1775 www.native-instruments.com -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWE6CaAAoJEE/6fkLwjZ+6ZR4P/iOHFukUcEMwBY0cYuKeNtyO 5Ox0T1HgZ9SCN+CNR1xNNpRib54/UFRHavhVa175BzH1yeoOONnP5B9V/wJqa8P9 h0NW9FLSBGHHlxQgERQk8jp6Ogs1PxAR79e10EJObja70WnWyfUOYBs4MZ9zgPke 7tx+/pSUUrCDE8efuVFzV1vzinKEkVV36kWitvvgjV/UOmW7iFn1FzBHQiTa7icO DXeY3/BnHV19V/RE3B2kTKgjLxMYbs6f9zwRiw+Qd602b38u9E7yRJl6UwbhGnkb R84087zsCHkjgL8a+oBo+Ee8sXYd02Er+qu1OzpQ1M2o4sZ9eDvBm0cKonLhu/w5 +ci3hHn3/ESn3K3aio2uZbhs61ppT+kd/j0888xxl53QOLs6Hb85H/1pRk6vvkQE pf+uYPVDATfByyMVn+4EMjuIRrs6Q7u3rH7dYnWoSUWqX03pnY6rKmk1K0ZXp8M6 z/KpgSiyPiE/OlGf1xWkjBXsoEImGqlQMPflPmggHFXgJq60DsZ8sGcMejHttK+b zMX3BWexfXN6yOWUcJSpAd8Q9fWa9nTB1b/Rh164fAncVabrJI9gmBbdA/1xcLRo GrC/iJ3066sxKRkhKGF2+2/qTAiUuvR+81C/F7s93LEWnIe8OJssAVN+cFqZ7v0F l8o/Qxtbx2mNYmeQ5EQN =WGxA -----END PGP SIGNATURE----- _______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
