0

The Mesos slave log file, which uses glog, doesn't have the year in it. It looks like this:

W0225 15:24:41.816625 7651 slave.cpp:2024] ......

I'm using filebeat to forward the logs to logstash. Is there any way in mesos to force it to put the year in the log file? Just adding the current year when logstash gets it puts a risk in there that it may put the wrong year when the year changes over.

I suspect I could have some logic that would check if the current month is 01, and the month in the incoming log is 12, use last year and not this year....

Anyone ever done a filter for this scenario? I'd rather have mesos just put the year in the log file though.

Alain Collins
  • 16,268
  • 2
  • 32
  • 55
Oggie
  • 387
  • 2
  • 5
  • 15

1 Answers1

0

The date filter should handle this since v2.1.

Alain Collins
  • 16,268
  • 2
  • 32
  • 55
  • I have "timestamp"=>"19:07:50.032858 02 26" which is missing the year and has the seconds down to the micro second. If I use this under date : match => [ "timestamp" , "HH:mm:ss.SSSSSS MM dd" ] I get a dateparseerror. You sure it's fixed? – Oggie Feb 26 '16 at 19:51
  • Which is causing the problem - the lack of the year or the microseconds? – Alain Collins Feb 26 '16 at 20:37
  • the lack of the year. If I pass the time to timestamp without the year like this: `mutate { add_field => { "timestamp" => "%{time} %{month} %{monthday}" } } date { match => [ "timestamp" , "HH:mm:ss MM dd" ] }` Then it fails – Oggie Mar 14 '16 at 18:23
  • The error in the logstash log is: `"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [timestamp]", "caused_by"=>{"type"=>"number_format_exception", "reason" =>"For input string: \"20:58:51 03 10\""}}}}` – Oggie Mar 14 '16 at 18:37