On Feb 2, 2014, at 10:47 PM, David Birdsong <[email protected]> wrote:
> I've got a simple one: > > here's the logstramer toml: > > [diamond-tailer] > type = "LogstreamerInput" > log_directory = "/data/log/diamond-archive" > file_match = 'archive\.log\.?((?P<Year>\d+)-(?P<Month>\d+)-(?P<Day>\d+))?' > priority = ["Year", "Month", "Day"] > > > here's the order it displays: > Found 1 Logstream(s) for section [diamond-tailer]. > > Logstream name: [diamond-tailer] > Files: 8 (printing oldest to newest) > /data/log/diamond-archive/archive.log > /data/log/diamond-archive/archive.log.2014-01-27 > /data/log/diamond-archive/archive.log.2014-01-28 > /data/log/diamond-archive/archive.log.2014-01-29 > /data/log/diamond-archive/archive.log.2014-01-30 > /data/log/diamond-archive/archive.log.2014-01-31 > /data/log/diamond-archive/archive.log.2014-02-01 > /data/log/diamond-archive/archive.log.2014-02-02 > > How do I get "/data/log/diamond-archive/archive.log" to be sorted to newest? If there is no part matched (as there wasn't for Year/Month/Day), than the default score assigned is -1. The general assumption was that the portion most frequently matched that is 'optional' is a sequence number (which is only at the end), where ppl frequently sort in reverse order, such that archive.log should come before archive.log.1. Unfortunately this means the only way to deal with this given the current implementation is to define the default for *all* the values of year/month/day which is definitely not going to be a good solution here (so that you can handle a 'missing value' default that makes sense). I think the best option in this case is to supply a new 'missing value' type option for a value so that you can declare what value a missing one should have, this way you could say that if Year is not in the file match, consider it a 2020 for sorting purposes or whatever. The config for that would work perhaps like this: [diamond-tailer] type = "LogstreamerInput" log_directory = "/data/log/diamond-archive" file_match = 'archive\.log\.?((?P<Year>\d+)-(?P<Month>\d+)-(?P<Day>\d+))?' priority = ["Year", "Month", "Day"] [diamon-tailer.translation.Year] missing = 2025 That would be sufficient in your case to ensure it was sorted as the newest. Would that work? Cheers, Ben
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Heka mailing list [email protected] https://mail.mozilla.org/listinfo/heka
