| EBernhardson added a comment. |
In T172710#3561315, @Gehel wrote:Logs are now sent to logstash, but the "host" field isn't set correctly (its value is always "%{HOSTNAME}". Some analysis:
- logs are sent over UDP, using the net.logstash.logback.appender.LogstashSocketAppender, to logstash port 11514
- logstash is configured with an input type=logstash, codec=json on that port
- logstash is configured to replace the hostname for [type] == logback ` mutate { replace => [ "host", "%{HOSTNAME}" ] add_tag => [ "logback", "es" ] } `
- the same configuration seem to work for Cassandra
I'm also a bit weak on my logstash, but if i understand correctly %{...} basically resolves to another field in the same document. That would imply that wdqs is not sending the HOSTNAME variable. If we look at the actual documents we can see that cassandra docs have the HOSTNAME variable, and wdqs do not. So the question is, why isn't wdqs sending this?
It looks like HOSTNAME was added in https://github.com/logstash/logstash-logback-encoder/commit/0c67cff00bc0e9e03f566f53bfe55e11a60fea27
The earliest tag that includes this commit is logstash-logback-encoder-2.1. It seems unlikely we are using a version older than that. Perhaps somehow wdqs isn't using the same defaults? It seems like hostname is addded by default with a bunch of other properties in current master, via LogstashAccessFormatter.java
Cc: EBernhardson, gerritbot, Aklapper, PokestarFan, Gehel, Lordiis, GoranSMilovanovic, Adik2382, Th3d3v1ls, Hfbn0, Ramalepe, Liugev6, QZanden, EBjune, merbst, Avner, Lewizho99, Zppix, Maathavan, debt, Jonas, FloNight, Xmlizer, Izno, jkroll, Smalyshev, Wikidata-bugs, Jdouglas, aude, Tobias1984, Manybubbles, faidon, Mbch331, Jay8g, fgiunchedi
_______________________________________________ Wikidata-bugs mailing list Wikidata-bugs@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikidata-bugs
