Summary for local -------------- Succeeded: 478 (changed=180) Failed: 0 -------------- Total states run: 478 Total run time: 68.410 s [Tue, 05 Jun 2018 14:33:17 +0200] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service. The system is finally up, after 144.81 seconds
filter {
dissect {
mapping => { "message" => "Summary for local -------------- Succeeded: %{states_succeeded} (changed=%{states_changed}) Failed: %{states_failed} -------------- \
Total states run: %{states_run} Total run time: %{run_time} s [%{agent_timestamp}] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service \
to /usr/lib/systemd/system/codedeploy-agent.service. The system is finally up, after %{cloudinit_time} seconds" }
}
}
This filter results in the assignment of the following indexes:
states_succeeded: 478
states_failed: (empty string)
states_changed: (empty string)
states_run: (empty string)
run_time: (empty string)
cloudinit_time: 180) Failed: 0 -------------- Total states run: 478 Total run time: 68.410 s [Tue, 05 Jun 2018 14:33:17 +0200] codedeploy-agent started Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service.
The system is finally up, after 144.81 seconds
The only correctly parsed index is "states_succeeded". Why is it so? It looks like the parentheses are confusing the dissect parser, but escaping them produces other errors.
I have exactly the same version and OS (v6.2.4 on Linux CentOS 7.5), and it is causing me endless headaches. Is there something else I should check? Here's my multiline config for Filebeat /etc/filebeat/filebeat.yml:
You have a multiline in filebeat? So your input will have embedded newlines. Your filter patterns need to match that. With no filters, what do you get from output { stdout { codec => rubydebug } } ?
dissect {
mapping => {
"message" => "Summary for local
--------------
Succeeded: %{states_succeeded} (changed=%{states_changed})
Failed: %{states_failed}
--------------
Total states run: %{states_run}
Total run time: %{run_time} s
[%{agent_timestamp}] codedeploy-agent started
Created symlink from /etc/systemd/system/multi-user.target.wants/codedeploy-agent.service to /usr/lib/systemd/system/codedeploy-agent.service.
The system is finally up, after %{cloudinit_time} seconds%{}"
}
}
Thanks for your answer. I solved it differently -- I've added a mutate filter to replace newlines with spaces, and it works at last. Thank you very much.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.