Line sequence with logstash

Elastic Stack Logstash
1

Good morning,
Can I get some help !
I have a log file, where the first data on each line is in timestamp format.
to do my analysis I need to know the order of these lines, so I used a new "seq" field with the ruby filter, as follows:

filter {
	ruby {
		path => "path/seq.rb"
	}	
}

my seq.rb is :

# encoding: binary

def register(params)
    @seq = 0
end

def filter(event)
    event.set("seq", @seq)
    @seq += 1
    return [event]
end

but my résult in kibana is :

 timestamp:20191101 00:00:00.390   seq = 5
 timestamp:20191101 00:00:00.500  seq = 1
2

Set pipeline.workers to 1 and you may also need to disable java_execution until you get to 7.7.

1 Like
3

I modified logstash.yml and I put pipeline.workers to 1.
But I don't know how to disable java execution, Is it like that?

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/gest.conf --java-execution false
4

Yes, you can do it on the command line, or else do it in logstash.yml

5

I have 7.7, and I get this when I run logstash :

[INFO ] 2020-05-29 15:57:43.657 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.7.0"}

I still need to make the changes?

6

You will need pipeline.workers 1 but will probably be OK without disabling java_execution.

1 Like
7

I've had workers =1 since the beginning but I still have the problem of these lines in disorder.
Can the encoding line at the beginning of my seq.rb file cause this problem?

8

I think it works now with -w 1:

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/gest.conf -w 1 --java-execution=false
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.