# Using logstash-output-gelf can I print my own message that will describe the issue cause

**URL:** https://discuss.elastic.co/t/using-logstash-output-gelf-can-i-print-my-own-message-that-will-describe-the-issue-cause/74790
**Category:** Logstash
**Created:** [February 12, 2017, 6:50am UTC](https://discuss.elastic.co/t/using-logstash-output-gelf-can-i-print-my-own-message-that-will-describe-the-issue-cause/74790 "2017-02-12T06:50:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sivaram](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sivaram](https://discuss.elastic.co/u/sivaram)
#### Post date: [February 12, 2017, 6:50am UTC](https://discuss.elastic.co/t/using-logstash-output-gelf-can-i-print-my-own-message-that-will-describe-the-issue-cause/74790/1 "2017-02-12T06:50:48Z")

</div>

# logFile

$ sudo vi /var/log/nova/nova-compute.log

2017-01-25 02:05:35.748 20820 CRITICAL nova [req-a5d425ae-b08e-450b-ac83-142733c35c99 - - - - -] AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.  
2017-01-25 02:05:35.748 20820 ERROR nova Traceback (most recent call last):  
2017-01-25 02:05:35.748 20820 ERROR nova File "/usr/bin/nova-compute", line 10, in

2017-01-25 02:05:35.748 20820 ERROR nova AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.  
2017-01-25 02:05:35.748 20820 ERROR nova

$ vi logstash-simple.conf

input {

file {  
type =\> "nova"  
path =\> "/var/log/nova/\*.log"  
}  
}

filter {

if [type] == "nova" {  
grok {  
match =\> { "message" =\>"%{TIMESTAMP\_ISO8601:timestamp} %{NUMBER:ProcessID} %{LOGLEVEL:loglevel} %{DATA:class} [(?:req-%{UUID} - - - - )?-] %{GREEDYDATA:Information}"}  
match =\> { "message" =\>"%{TIMESTAMP\_ISO8601:timestamp} %{NUMBER:ProcessID} %{LOGLEVEL:loglevel} %{DATA:class} %{GREEDYDATA:Information}"}

}

mutate {

```
  remove_field => ["message"]

```

}  
}  
}

output {

if [type] == "nova" {

elasticsearch {  
hosts =\> ["localhost:9200"]

}  
if [loglevel] == "CRITICAL" {

```
  stdout {
     codec => rubydebug

```

}

}  
if [loglevel] == "ERROR" {

```
  stdout {
     codec => rubydebug

```

}

}

if [Information] == "AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile." {

```
  gelf {

     host => "localhost"
     short_message => "Wrong RabbitMQ credentials"

```

}

}

}

# Output

vedams@openstackaio:~/logstash-5.1.2$ bin/logstash -f logstash-simple.conf  
Sending Logstash's logs to /home/vedams/logstash-5.1.2/logs which is now configured via log4j2.properties  
[2017-01-25T23:12:02,261][INFO][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>["[http://localhost:9200](http://localhost:9200)"]}}  
[2017-01-25T23:12:02,268][INFO][logstash.outputs.elasticsearch] Running health check to see if an Elasticsearch connection is working {:url=\>#\<URI::HTTP:0x62f989f7 URL:[http://localhost:9200](http://localhost:9200)\>, :healthcheck\_path=\>"/"}  
[2017-01-25T23:12:02,601][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x62f989f7 URL:[http://localhost:9200](http://localhost:9200)\>}  
[2017-01-25T23:12:02,616][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
[2017-01-25T23:12:02,762][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[2017-01-25T23:12:02,786][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["localhost:9200"]}  
[2017-01-25T23:12:03,400][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>3, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>375}  
[2017-01-25T23:12:03,478][INFO][logstash.pipeline] Pipeline main started  
[2017-01-25T23:12:03,605][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

{  
"path" =\> "/var/log/nova/nova-compute.log",  
"@timestamp" =\> 2017-01-25T17:42:31.017Z,  
"loglevel" =\> "CRITICAL",  
"@version" =\> "1",  
"host" =\> "openstackaio",  
"ProcessID" =\> "3006",  
"type" =\> "nova",  
"Information" =\> "AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.",  
"class" =\> "nova",  
"timestamp" =\> "2017-01-25 23:12:30.357"  
}  
[2017-01-25T23:12:31,393][WARN][logstash.outputs.gelf] Trouble sending GELF event {:gelf\_event=\>{"short\_message"=\>nil, "full\_message"=\>"%{message}", "host"=\>"openstackaio", "\_path"=\>"/var/log/nova/nova-compute.log", "\_loglevel"=\>"CRITICAL", "\_ProcessID"=\>"3006", "\_type"=\>"nova", "\_Information"=\>"AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.", "\_class"=\>"nova", "\_timestamp"=\>"2017-01-25 23:12:30.357", "level"=\>6}, :event=\>2017-01-25T17:42:31.017Z openstackaio %{message}, :error=\>#\<ArgumentError: short\_message is missing. Options version, short\_message and host must be set.\>}  
{  
"path" =\> "/var/log/nova/nova-compute.log",  
"@timestamp" =\> 2017-01-25T17:42:31.020Z,  
"loglevel" =\> "ERROR",  
"@version" =\> "1",  
"host" =\> "openstackaio",  
"ProcessID" =\> "3006",  
"type" =\> "nova",  
"Information" =\> " File "/usr/lib/python2.7/dist-packages/nova/cmd/compute.py", line 74, in main",  
"class" =\> "nova",  
"timestamp" =\> "2017-01-25 23:12:30.357"  
}

{  
"path" =\> "/var/log/nova/nova-compute.log",  
"@timestamp" =\> 2017-01-25T17:42:31.745Z,  
"loglevel" =\> "ERROR",  
"@version" =\> "1",  
"host" =\> "openstackaio",  
"ProcessID" =\> "3006",  
"type" =\> "nova",  
"Information" =\> "AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.",  
"class" =\> "nova",  
"timestamp" =\> "2017-01-25 23:12:30.357"  
}  
[2017-01-25T23:12:31,393][WARN][logstash.outputs.gelf] Trouble sending GELF event {:gelf\_event=\>{"short\_message"=\>nil, "full\_message"=\>"%{message}", "host"=\>"openstackaio", "\_path"=\>"/var/log/nova/nova-compute.log", "\_loglevel"=\>"CRITICAL", "\_ProcessID"=\>"3006", "\_type"=\>"nova", "\_Information"=\>"AccessRefused: (0, 0): (403) ACCESS\_REFUSED - Login was refused using authentication mechanism AMQPLAIN. For details see the broker logfile.", "\_class"=\>"nova", "\_timestamp"=\>"2017-01-25 23:12:30.357", "level"=\>6}, :event=\>2017-01-25T17:42:31.017Z openstackaio %{message}, :error=\>#\<ArgumentError: short\_message is missing. Options version, short\_message and host must be set.\>}

---

<div class="post-metadata">

### Author: ![sivaram](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@sivaram](https://discuss.elastic.co/u/sivaram)
#### Post date: [February 12, 2017, 6:53am UTC](https://discuss.elastic.co/t/using-logstash-output-gelf-can-i-print-my-own-message-that-will-describe-the-issue-cause/74790/2 "2017-02-12T06:53:01Z")

</div>

I was getting errors. I just tried with Gelf. Is there any other alternative way to report the cause for the log issue.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2017, 6:53am UTC](https://discuss.elastic.co/t/using-logstash-output-gelf-can-i-print-my-own-message-that-will-describe-the-issue-cause/74790/3 "2017-03-12T06:53:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.