Hello,
I'd appreciate some guidance where logstash isn't triggering our exec command in spite of there being a valid string found by our filter.
We have a third party service running on our Windows server which is writing to two separate log files (monitored by logstash). The issue is when the service shuts down it writes a specific entry to one of the log files we want logstash to trigger a command on. The problem is when the service shuts down it writes the entry to the log but logstash doesn't exec the command until we restart the service. It's almost like (for lack of better term) logstash is stuck or in some limbo state? When the service shuts down we see the sincedb file updated immediately but logstash isn't triggering our process (until we restart the service). Logstash 2.3.2 on Windows. Are we missing something?
Here's our config:
input {
file {
path => [ C:\Application\Db\error.log","C:\Application\Db\armonitor.log" ]
codec =>
multiline {
pattern => "(^Sun)|(^Mon)|(^Tue)|(^Wed)|(^Thu)|(^Fri)|(^Sat)"
what => previous
negate =>true
}
}
}
filter {
grok {
match => {"message" => "%{WORD:arm_dow} %{WORD:arm_month} %{NUMBER:arm_day} %{TIME:arm_time} %{NUMBER:arm_year} %{GREEDYDATA:monlog}" }
}
if (("Monitor stopped." in [monlog]) or ("The Server process terminated." in [monlog]) or ("Unable to start server process." in [monlog])) {
mutate {
add_tag => [ "FOUND-IN-MONITORFILE" ]
}
}
if (("(ERR90)" in [monlog]) or ("(ERR 93)" in [monlog]) or ("(ERR92)" in [monlog]) or ("(ERR 550)" in [monlog]) or ("(ERR551)" in [monlog]) or ("(ERR 552)" in [monlog]) or ("(ERR 8760)" in [monlog]) or ("(NOTE 802)" in [monlog]) or ("(NOTE 803)" in [monlog])) {
mutate {
add_tag => [ "FOUND-IN-ERRORLOG"]
}
} else if ("FOUND-IN-MONITORFILE" not in [tags]) {
drop { }
}
}
output {
exec {
command => "C:\Logstash\logstash-2.3.2\bin\log-viewer.bat "%{message}" "%{host}""
}
file {
path => "C:\Logstash\logstash-2.3.2\log\stasharm.txt"
}
}
Thank you,
Chris