API tools faq
paste
Advertisement
Guest User

logstach date debug

a guest
Oct 30th, 2014
90
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.44 KB | None | 0 0
raw download clone embed print report
  1. configuration :
  2. input {
  3. stdin { }
  4. }
  5.  
  6. filter {
  7. mutate { replace => { "type" => "apache_access" } }
  8. grok {
  9. match => { "message" => "%{COMBINEDAPACHELOG}" }
  10. }
  11.  
  12. date {
  13. match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  14. }
  15. mutate {
  16. convert => [ "bytes", "integer" ]
  17. convert => [ "response", "integer" ]
  18. }
  19. }
  20.  
  21. stdin :
  22. 192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] "POST //render HTTP/1.1" 200 3749 "http://graphite/grafana/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36"
  23.  
  24. logs :
  25.  
  26. filter received {:event=>{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template"}, :level=>:debug, :file=>"(eval)", :line=>"21"}
  27.  
  28. Running grok filter {:event=>#<LogStash::Event:0x5be4b515 @accessors=#<LogStash::Util::Accessors:0x42ca4d5 @store={"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access"}, @lut={"host"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access"}, "host"], "type"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access"}, "type"]}>, @data={"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access"}, @cancelled=false>, :level=>:debug, :file=>"logstash/filters/grok.rb", :line=>"280"}
  29.  
  30. Event now: {:event=>#<LogStash::Event:0x5be4b515 @accessors=#<LogStash::Util::Accessors:0x42ca4d5 @store={"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, @lut={"host"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "host"], "type"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "type"], "message"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "message"], "clientip"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "clientip"], "ident"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "ident"], "auth"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "auth"], "timestamp"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "timestamp"], "verb"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "verb"], "request"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "request"], "httpversion"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "httpversion"], "response"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "response"], "bytes"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "bytes"], "referrer"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "referrer"], "agent"=>[{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, "agent"]}>, @data={"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>"200", "bytes"=>"3749", "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, @cancelled=false>, :level=>:debug, :file=>"logstash/filters/grok.rb", :line=>"300"}
  31.  
  32. Date filter: received event {:type=>"apache_access", :level=>:debug, :file=>"logstash/filters/date.rb", :line=>"178"}
  33.  
  34. Date filter looking for field {:type=>"apache_access", :field=>"timestamp", :level=>:debug, :file=>"logstash/filters/date.rb", :line=>"181"}
  35. Failed parsing date from field {:field=>"timestamp", :value=>"30/Oct/2014:11:55:08 +0100", :exception=>java.lang.IllegalArgumentException: Invalid format: "30/Oct/2014:11:55:08 +0100" is malformed at "Oct/2014:11:55:08 +0100", :level=>:warn, :file=>"logstash/filters/date.rb", :line=>"213"}
  36.  
  37. output received {:event=>{"message"=>"192.168.1.203 - - [30/Oct/2014:11:55:08 +0100] \"POST //render HTTP/1.1\" 200 3749 \"http://graphite/grafana/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\"", "@version"=>"1", "@timestamp"=>"2014-10-30T10:57:16.185Z", "host"=>"template", "type"=>"apache_access", "clientip"=>"192.168.1.203", "ident"=>"-", "auth"=>"-", "timestamp"=>"30/Oct/2014:11:55:08 +0100", "verb"=>"POST", "request"=>"//render", "httpversion"=>"1.1", "response"=>200, "bytes"=>3749, "referrer"=>"\"http://graphite/grafana/\"", "agent"=>"\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2046.0 Safari/537.36\""}, :level=>:debug, :file=>"(eval)", :line=>"82"}
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!