Hi Cristian, I'm not sure how you can mess it up with your rsyslog configuration. Unless the index doesn't exist, and your first message (or hostname or other string field) is "1" or something similar that Elasticsearch detects as a numeric field. Then, when you come with the string, it will complain.
Another thing that will make it complain is to send a corrupted JSON. -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Wed, Aug 27, 2014 at 1:00 PM, Cristian Falcas <[email protected]> wrote: > Hi Radu, > > I can do this from rsyslog also? I'm using this template to send data: > > template(name="es_template" type="subtree" subtree="$!") > > where the subtree is populated by mmnormalize rules and some manual ones, > like: > > set $!message = $msg; > set $!hostname = $hostname; > > > > > > On Tue, Aug 26, 2014 at 5:39 PM, Radu Gheorghe <[email protected] > > > wrote: > > > On Tue, Aug 26, 2014 at 2:58 PM, Cristian Falcas < > [email protected]> > > wrote: > > > > > Hello, > > > > > > I tested the branch now, and it seems to work correctly. Meaning that > > there > > > are no "" messages in errorFiles. I don't know how to force elastic > > search > > > to reject messages, so I didn't test if in case of error there is also > a > > > message from rsyslog, > > > > > > > > Hi Cristian, > > > > Thanks for testing this! It looks like I can't help right now :( > > > > To make ES reject a message, define a mapping with an integer field, and > > try to send a string to that field from rsyslog. For example, make "msg" > > integer or something like that. It will cry like a baby. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
