I forget the module to extract every name of Puppet modules:
"condition_type": "regex",
"condition_value":
"^\\d+-\\d+-\\d+\\s+\\d+:\\d+:\\d+\\s+-\\d+\\s+\\/+Stage+\\[+main+\\]+\\/(.*?)+\\/",
"converters": [],
"cursor_strategy": "copy",
"extractor_config": {
"index": 3,
"split_by": "/"
},
"extractor_type": "split_and_index",
"order": 0,
"source_field": "full_message",
"target_field": "puppetModule",
"title": "Puppet main Module name"
}
],
On Monday, September 7, 2015 at 2:23:57 PM UTC-3, Juan Andres Ramirez wrote:
>
> Hello,
> I download the extractor Puppet from Marketplace, but this isn't
> working to free version of Puppet (Puppet labs). I modified this extractor
> and now is working as well.
> Copy /paste my edited extractor for puppet:
>
> "extractor_type": "regex",
> "order": 0,
> "source_field": "message",
> "target_field": "puppetError",
> "title": "Puppet error - DevOps"
> },
> {
> "condition_type": "regex",
> "condition_value":
> "^\\d+-+\\d+-\\d+\\s+\\d+:+\\d+:\\d+\\s+-\\d+\\s+Puppet+\\s+\\(+notice+\\)+:\\s+Finished+\\s+catalog+\\s+run+\\s+in+\\s+(\\d[0-9]{0,9}\\.[0-9]{0,9})+\\s+seconds",
> "converters": [
> {
> "config": {},
> "type": "numeric"
> }
> ],
> "cursor_strategy": "copy",
> "extractor_config": {
> "regex_value": "Finished catalog run in
> ((\\d[0-9]{0,9}\\.[0-9]{0,9})) seconds"
> },
> "extractor_type": "regex",
> "order": 0,
> "source_field": "full_message",
> "target_field": "puppetRunTime",
> "title": "Puppet: Puppet run time - DevOps"
> },
> {
> "condition_type": "regex",
> "condition_value":
> "^\\d+-+\\d+-\\d+\\s+\\d+:+\\d+:\\d+\\s+-\\d+\\s+Puppet+\\s+\\(+info+\\)+:\\s+Applying+\\s+configuration+\\s+version+\\s+'(\\d[0-9]{0,9})+'",
> "converters": [
> {
> "config": {},
> "type": "numeric"
> }
> ],
> "cursor_strategy": "copy",
> "extractor_config": {
> "regex_value":
> "^\\d+-+\\d+-\\d+\\s+\\d+:+\\d+:\\d+\\s+-\\d+\\s+Puppet+\\s+\\(+info+\\)+:\\s+Applying+\\s+configuration+\\s+version+\\s+'(\\d[0-9]{0,9})+'"
> },
> "extractor_type": "regex",
> "order": 0,
> "source_field": "full_message",
> "target_field": "puppetConfigVersion",
> "title": "Puppet: Puppet Configuration Version - DevOps"
> },
> {
>
>
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/37fbf03d-ac85-47df-93b5-fa02f4b583ce%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
