Severity labels

(Jordan) #1

Hi there! I wanted to check something regarding logging. This might be meant for Watcher but I wasn't sure.

I want to try and label my logs based on their values. Lets say I want four categories: Okay, Problem, Warning, Danger.

"Okay" is where nothing is particularly wrong with the values.

"Problem" is where there is a spike within the data.

"Warning" is when there is a constant spike. (For example there have been 10 "Problem" previous logs and when it rises above 10 logged "Problem" it turns into "Warning")

"Danger" would appear when there is a dangerous value within the logs. For example it reads that the http status of the server is 404 or when the memory only has 5% left.

Is there something within Logstash (or any of the other components) which can assist me with this? If not is there a way to make this?

My goal is to watch the health of a single server (not the health check component of indices, though similar but on a smaller scale)

(Mark Walkom) #2

You could do some of this with a mutate filter, where if http status is 404 then add a tag.

Not sure about the rest though, you may be able to use a metric filter to do a similar thing?

(system) #3