Re: [rsyslog] Logstash vs. omelasticsearch

2016-12-16 Thread David Lang
On Fri, 16 Dec 2016, Micah Yoder wrote: On 11/21/2016 05:21 PM, David Lang wrote: On Mon, 21 Nov 2016, Micah Yoder wrote: The other reason I preferred Logstash was the configuration format was a bit more user-friendly than some of the equivalent rsyslog rules. can you provide some more info

Re: [rsyslog] Logstash vs. omelasticsearch

2016-12-16 Thread Micah Yoder
On 11/21/2016 05:21 PM, David Lang wrote: On Mon, 21 Nov 2016, Micah Yoder wrote: The other reason I preferred Logstash was the configuration format was a bit more user-friendly than some of the equivalent rsyslog rules. can you provide some more info about the issues you had? Hi David, sor

Re: [rsyslog] rsyslogd: gnutls returned error on handshake: A TLS packet with unexpected length was received.

2016-12-16 Thread Micah Yoder
We have the same log messages and are using it in the same way. We have a story in the backlog to investigate, but haven't got to it yet. It doesn't seem to be losing messages. On 12/13/2016 03:31 PM, yingchun cai via rsyslog wrote: Hi, All I use rsyslog-gnutls-8.23.0-1.el6.x86_64rsyslog-8

Re: [rsyslog] Are we building an ERK stack?

2016-12-16 Thread mostolog--- via rsyslog
This is exactly why we have $. variables as well as $! variables. They work exactly the same, but by convention, $! variables are where you put things that you are going to want to send elsewhere, and $. variables are where you put things that you need to create for your internal logic, templ

[rsyslog] liblognorm segfault ?

2016-12-16 Thread mostolog--- via rsyslog
Hi Having more problems with liblognorm. Let me now if I should open an issue. echo "a" | /usr/lib/lognorm/lognormalizer -r a.rb Segmentation fault (core dumped) File: version=2 #foo type=@rfc3164pri:<%priority:number%> type=@rfc3164header:%date:date-rfc3164% %hostname:wor

Re: [rsyslog] Are we building an ERK stack?

2016-12-16 Thread David Lang
On Thu, 15 Dec 2016, mostolog--- via rsyslog wrote: Solved using json template (code blindness). Is there any way to set fields and use them (like @timestamp) but not indexing them on elastic? (hidden fields) Just tried with @timestamp, but it's being indexed :( This is exactly why we hav