Title

Saturday, 7 February 2015

Logstash Fields not passing to statsd outout filter


I can't seem to get fields values properly passing to my statsd instance.

A log line might look like:

GET https://endpoint.com/test (127.0.0.1) 10ms  

I keep sending metrics to statsd that look like:

cloud.host-n01_host_com.route.%{friendlyname}:758.69|ms  

Here's the config file. It seems like this should be fairly straight forward.

filter {   grok {   match => { "message" => [ "%{WORD:verb} %{URIPATHPARAM:request} \(%{IPORHOST:clientip}\) %{NUMBER:timetaken}ms" ] }   add_field => [ "metrictype", "route" ]   }     # ROUTES MATCH   if [metrictype] == "route" {   if [request] =~ /https:\/\/endpoint.com/ {   alter { ### alter was tried because the mutate param does the same thing...   add_field => [ "friendlyname", "endpoint_com" ] # format for statsd   }   }   }  }    output {   statsd {   debug => false   host => "127.0.0.1"   port => 8125   namespace => "cloud"   timing => [ "%{metrictype}.%{friendlyname}", "%{timetaken}" ]   increment => "%{metrictype}.%{friendlyname}.httpcode.%{httpcode}"   }  }  
Answer

No comments:

Post a Comment