As I stated in another reply on this thread, I don't understand exactly
what you're asking. You'll probably have better luck if you step back a
bit and explain what you're trying to accomplish at a higher level.
-r
On 10/06/2015 03:21 AM, Robert Gardam wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Good question.
I am still not sure how to split streams. Now I can parse the access
log from the output from the json decoder, but can't pass these same
messages into the nginx error module.
Any ideas?
On 06/10/15 11:06, Christian Kniep wrote:
Hey y'all,
on that topic ‘kinda replacing Logstash’.
I am not mistaken it’s possible to chain multiple steps together as
one would do in logstash, correct? I use the [ProcStatDecoder] and
pass it in a couple of steps towards the [LogOutput] by stating the
previous step in the ‘message_type’. As far as I understood it (or
hope it works) it will parse all the config and afterwards create
the correct workflow based on the matcher and name of the steps.
Cheers Christian
--
Christian Kniep | Release Engineer
www.gaikai.com <http://www.gaikai.com/>
On 06 Oct 2015, at 10:32, Robert Gardam
<[email protected]
<mailto:[email protected]>> wrote:
I managed to get it to work. I think the only way to make this
work is to use the multi-decoder as I still need all other syslog
messages to be processed in heka and passed onto es.
On 05/10/15 22:58, Rob Miller wrote:
On 10/5/15 9:59 AM, Robert Gardam wrote:
Hi All, I'm just trying out moving from logstash and I'm
wondering how does one push one message from one decoder into
another decoder after it has been decoded the first time.
Essentially i'm decoding json rsyslog messages from a tcp
input and then I want to pass only one field into the nginx
access log decoder.
Most of the work for the nginx access decoder is done in a
module, so I'd recommend just copying the nginx decoder code
and adding your JSON parsing right in the same decoder.
I can multi decode, but this only seems to decode json first
but not pass the json message into the second decoder.
MultiDecoder should work, albeit less efficiently. You have to
set `cascade_strategy = "all"` (the default is "first-wins")
for your use case, though; did you set that?
-r
_______________________________________________ Heka mailing
list [email protected] <mailto:[email protected]>
https://mail.mozilla.org/listinfo/heka
-- Robert Gardam DevOps Engineer Native Instruments GmbH
+49-30-611035-1775
www.native-instruments.com <http://www.native-instruments.com>
_______________________________________________ Heka mailing
list [email protected] https://mail.mozilla.org/listinfo/heka
- --
Robert Gardam
DevOps Engineer
Native Instruments GmbH
+49-30-611035-1775
www.native-instruments.com
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJWE6CaAAoJEE/6fkLwjZ+6ZR4P/iOHFukUcEMwBY0cYuKeNtyO
5Ox0T1HgZ9SCN+CNR1xNNpRib54/UFRHavhVa175BzH1yeoOONnP5B9V/wJqa8P9
h0NW9FLSBGHHlxQgERQk8jp6Ogs1PxAR79e10EJObja70WnWyfUOYBs4MZ9zgPke
7tx+/pSUUrCDE8efuVFzV1vzinKEkVV36kWitvvgjV/UOmW7iFn1FzBHQiTa7icO
DXeY3/BnHV19V/RE3B2kTKgjLxMYbs6f9zwRiw+Qd602b38u9E7yRJl6UwbhGnkb
R84087zsCHkjgL8a+oBo+Ee8sXYd02Er+qu1OzpQ1M2o4sZ9eDvBm0cKonLhu/w5
+ci3hHn3/ESn3K3aio2uZbhs61ppT+kd/j0888xxl53QOLs6Hb85H/1pRk6vvkQE
pf+uYPVDATfByyMVn+4EMjuIRrs6Q7u3rH7dYnWoSUWqX03pnY6rKmk1K0ZXp8M6
z/KpgSiyPiE/OlGf1xWkjBXsoEImGqlQMPflPmggHFXgJq60DsZ8sGcMejHttK+b
zMX3BWexfXN6yOWUcJSpAd8Q9fWa9nTB1b/Rh164fAncVabrJI9gmBbdA/1xcLRo
GrC/iJ3066sxKRkhKGF2+2/qTAiUuvR+81C/F7s93LEWnIe8OJssAVN+cFqZ7v0F
l8o/Qxtbx2mNYmeQ5EQN
=WGxA
-----END PGP SIGNATURE-----
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
