Hi Joseph!
Is the GELF UDP input running properly on the server with the .112 ip?
You need to configure it first, it is not starting automatically.
Then everything should be working.
Best,
Kay
On Saturday, April 19, 2014 2:19:57 PM UTC+2, Joseph DJOMEDA wrote:
>
> Hello Good People,
>
> I am coming from splunk background with even little experience on it. But
> I am having issue getting basic stuff done. I have graylog2 server and web
> interface running fine let's say on IP :112. I have a java application
> running on a server IP : 27. the log of the app is of the type shown below.
> I know it needs some cleanups but I am more concerned about sending
> something to graylog2:
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *2014-04-01 21:54:17,398 INFO [Thread-2]
> [org.hibernate.service.jdbc.connections.internal.C3P0ConnectionProvider] -
> HHH000006: Autocommit mode: true2014-04-01 21:54:17,399 WARN [Thread-2]
> [org.hibernate.service.jdbc.connections.internal.C3P0ConnectionProvider] -
> HHH000148: No JDBC Driver class was specified by property
> hibernate.connection.driver_class2014-04-01 21:54:17,425 INFO [Thread-2]
> [com.mchange.v2.log.MLog] - MLog clients using log4j logging.2014-04-01
> 21:54:17,545 INFO [Thread-2] [com.mchange.v2.c3p0.C3P0Registry] -
> Initializing c3p0-0.9.1 [built 16-January-2007 14:46:42; debug? true;
> trace: 10]2014-04-01 21:54:17,930 INFO [Thread-2]
> [com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource] - Initializing c3p0
> pool... com.mchange.v2.c3p0.PoolBackedDataSource@d678e16f [
> connectionPoolDataSource ->
> com.mchange.v2.c3p0.WrapperConnectionPoolDataSource@7bb4a24 [
> acquireIncrement -> 2, acquireRetryAttempts -> 30, acquireRetryDelay ->
> 1000, autoCommitOnClose -> false, automaticTestTable -> null,
> breakAfterAcquireFailure -> false, checkoutTimeout -> 0,
> connectionCustomizerClassName -> null, connectionTesterClassName ->
> com.mchange.v2.c3p0.impl.DefaultConnectionTester,
> debugUnreturnedConnectionStackTraces -> false, factoryClassLocation ->
> null, forceIgnoreUnresolvedTransactions -> false, identityToken ->
> nm1r17918k7ta81op67fy|71b3cc1f, idleConnectionTestPeriod -> 300,
> initialPoolSize -> 3, maxAdministrativeTaskTime -> 0, maxConnectionAge ->
> 0, maxIdleTime -> 60000, maxIdleTimeExcessConnections -> 0, maxPoolSize ->
> 40, maxStatements -> 0, maxStatementsPerConnection -> 0, minPoolSize -> 2,
> nestedDataSource -> com.mchange.v2.c3p0.DriverManagerDataSource@2ba1b5de [
> description -> null, driverClass -> null, factoryClassLocation -> null,
> identityToken -> nm1r17918k7ta81op67fy|67f095ba, jdbcUrl ->
> jdbc:mysql://localhost:3306/do_my_app, properties -> {user=******,
> password=******, autocommit=true, driverClassName=com.mysql.jdbc.Driver,
> release_mode=auto} ], preferredTestQuery -> null, propertyCycle -> 0,
> testConnectionOnCheckin -> false, testConnectionOnCheckout -> false,
> unreturnedConnectionTimeout -> 0, usesTraditionalReflectiveProxies ->
> false; userOverrides: {} ], dataSourceName -> null, factoryClassLocation ->
> null, identityToken -> nm1r17918k7ta81op67fy|51af67f9, numHelperThreads ->
> 3 ]2014-04-01 21:54:18,453 INFO [Thread-2] [org.hibernate.dialect.Dialect]
> - HHH000400: Using dialect: org.hibernate.dialect.MySQLDialect *
>
> I got logstash on the server IP: 27 and have its configuration shown below:
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *#logstash for IP 27 server# logstash.conf fileinput { file { type =>
> my_app path => ["/opt/tomcatinstances/my_app/logs/catalina.out"]
> }} filter { grok { match => {"message" => %{DATESTAMP_EVENTLOG:datestamp}
> %{LOGLEVEL:loglevel} \[%{WORD:thread}\] \[%{GREEDYDATA:classinfo}\]
> %{WORD:loginfo}"} } } output { gelf { host => "xxx.xxx.xxx.112" facility =>
> "%{@type}" custom_fields => ["environment", "production"] }}*
>
> when I run bin/logstash --debug -f logstasb.conf I have bunch of the
> following
>
>
>
>
>
>
>
> *=>"my_server_name",
> "path"=>"/opt/tomcatinstances/my_app/logs/catalina.out",
> "tags"=>["_grokparsefailure"]}, "tags"]}>, @data={"message"=>"
> voucher_type vouchertyp0_", "@version"=>"1",
> "@timestamp"=>"2014-04-19T10:55:17.333Z", "type"=>"my_app",
> "host"=>"my_server_name",
> "path"=>"/opt/tomcatinstances/my_app/logs/catalina.out",
> "tags"=>["_grokparsefailure"]}, @cancelled=false>, :level=>:debug,
> :file=>"logstash/filters/grok.rb", :line=>"310"}["Sending GELF event",
> {"short_message"=>" from", "full_message"=>" from",
> "host"=>"my_server_name", "facility"=>"%{@type}", "_type"=>"my_app",
> "_path"=>"/opt/tomcatinstances/my_app/logs/catalina.out",
> "_tags"=>"_grokparsefailure", "_environment"=>"production", "level"=>6}]
> {:level=>:debug, :file=>"logstash/outputs/gelf.rb", :line=>"203"}output
> received {:event=>{"message"=>" voucher_type vouchertyp0_",
> "@version"=>"1", "@timestamp"=>"2014-04-19T10:55:17.333Z",
> "type"=>"my_app", "host"=>"my_server_name",
> "path"=>"/opt/tomcatinstances/my_app/logs/catalina.out",
> "tags"=>["_grokparsefailure"]}, :level=>:debug, :file=>"(eval)",
> :line=>"34"}["Sending GELF event", {"short_message"=>" voucher_type
> vouchertyp0_", "full_message"=>" voucher_type vouchertyp0_",
> "host"=>"my_server_name", "facility"=>"%{@type}", "_type"=>"my_app",
> "_path"=>"/opt/tomcatinstances/my_app/logs/catalina.out",
> "_tags"=>"_grokparsefailure", "_environment"=>"production", "level"=>6}]
> {:level=>:debug, :file=>"logstash/outputs/gelf.rb",
> :line=>"203"}_discover_file_glob:
> /opt/tomcatinstances/my_app/logs/catalina.out: glob is:
> ["/opt/tomcatinstances/my_app/logs/catalina.out"] {:level=>:debug,
> :file=>"filewatch/watch.rb", :line=>"117"}_discover_file_glob:
> /opt/tomcatinstances/my_app/logs/catalina.out: glob is:
> ["/opt/tomcatinstances/my_app/logs/catalina.out"] {:level=>:debug,
> :file=>"filewatch/watch.rb", :line=>"117"}_discover_file_glob:
> /opt/tomcatinstances/my_app/logs/catalina.out: glob is:
> ["/opt/tomcatinstances/my_app/logs/catalina.out"] {:level=>:debug,
> :file=>"filewatch/watch.rb", :line=>"117"}*
>
> I do not think anything good is happening , besides graylog still
> complaining about not receiving any input and it's annoyingly blinking
>
> *There is a node without any running inputs. 5 days ago *
> * There is a node without any running inputs. This means that you are not
> receiving any messages from this node at this point in time. This is most
> probably an indication of an error or misconfiguration. You can click here
> <http://188.138.98.112:9000/system/inputs> to solve this*
>
> Can anyone please shed some light? Thank you
>
--
You received this message because you are subscribed to the Google Groups
"graylog2" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
