Heka Inputs - История изменений

Sirmax: /* LogstreamerInput */

2016-02-09T15:45:18Z

LogstreamerInput

← Предыдущая		Версия 15:45, 9 февраля 2016
Строка 102:		Строка 102:
	==LogstreamerInput==		==LogstreamerInput==
	Logstream input tails a single log file, a sequential single log source, or multiple log sources of either a single logstream or multiple logstreams.		Logstream input tails a single log file, a sequential single log source, or multiple log sources of either a single logstream or multiple logstreams.
−	<BR>More detals: https://hekad.readthedocs.org/en/v0.10.0/config/inputs/logstreamer.html	+	<BR>More detals: [https://hekad.readthedocs.org/en/v0.10.0/config/inputs/logstreamer.html Logstream input manual]
	<BR>		<BR>
	There are following inputs configured on controller:		There are following inputs configured on controller:

Sirmax: /* AMQPInput */

2016-02-09T15:44:43Z

AMQPInput

← Предыдущая		Версия 15:44, 9 февраля 2016
Строка 8:		Строка 8:
	On controller there are following inputs groups:		On controller there are following inputs groups:
	==AMQPInput==		==AMQPInput==
−	~~AMQP input (~~https://hekad.readthedocs.org/en/v0.10.0/config/inputs/amqp.html)	+	[https://hekad.readthedocs.org/en/v0.10.0/config/inputs/amqp.html AMQP input]:
	<BR>		<BR>
	There are followinf AMQP inputs:		There are followinf AMQP inputs:

Sirmax в 13:42, 9 февраля 2016

2016-02-09T13:42:29Z

← Предыдущая		Версия 13:42, 9 февраля 2016
Строка 3:		Строка 3:
	[[Категория:MOS FUEL]]		[[Категория:MOS FUEL]]
	[[Категория:Linux]]		[[Категория:Linux]]
		+	[[Категория:Monitoring]]
	=Inputs=		=Inputs=

Sirmax в 13:36, 9 февраля 2016

2016-02-09T13:36:39Z

← Предыдущая		Версия 13:36, 9 февраля 2016
Строка 1:		Строка 1:
		+	[[Категория:Heka]]
		+	[[Категория:LMA]]
		+	[[Категория:MOS FUEL]]
		+	[[Категория:Linux]]
	=Inputs=		=Inputs=

Sirmax: /* Spliter short remark */

2016-01-31T15:48:25Z

Spliter short remark

← Предыдущая		Версия 15:48, 31 января 2016
Строка 163:		Строка 163:
	===Spliter short remark===		===Spliter short remark===
	For better undestanding in is necessary to say few words about splitters.<BR>		For better undestanding in is necessary to say few words about splitters.<BR>
−	This splitter is very simple: each openstack log contains leading ~~part~~ '<number>', ~~e.g.~~ we ~~can~~ ~~check~~ ~~all~~ ~~unique~~ ~~fields:~~	+	This splitter is very simple: each openstack log contains leading '<number>' which used as "message start mark".<>
		+	E.g. you can see in logs:
	<PRE>		<PRE>
	# cat /var/log/*all.log \| sort -u -t'>' -k1,1		# cat /var/log/*all.log \| sort -u -t'>' -k1,1
Строка 180:		Строка 181:
	</PRE>		</PRE>

−	This number in ~~log~~ is PRI rsyslog field (injected by rsyslog logger):	+	This 'leading number' in logs is PRI rsyslog field injected by rsyslog system logger:
	<BR>		<BR>
	{{quote\|		{{quote\|

Sirmax: /* Spliter short remark */

2016-01-31T15:44:33Z

Spliter short remark

← Предыдущая		Версия 15:44, 31 января 2016
Строка 190:		Строка 190:
	</PRE>		</PRE>

−	So all messages ~~comes~~ via system logging (provided by rsyslog in MOS) have <PRI> prefix	+	So all messages come via system logging (provided by rsyslog in MOS) have <PRI> prefix

Sirmax: /* Spliter short remark */

2016-01-31T15:42:57Z

Spliter short remark

← Предыдущая		Версия 15:42, 31 января 2016
Строка 190:		Строка 190:
	</PRE>		</PRE>

−	So all messages comes via system logging (provided by rsyslog in MOS) ~~are~~ ~~having~~ <PRI> prefix	+	So all messages comes via system logging (provided by rsyslog in MOS) have <PRI> prefix

Sirmax: /* Spliter short remark */

2016-01-31T15:42:31Z

Spliter short remark

← Предыдущая		Версия 15:42, 31 января 2016
Строка 162:		Строка 162:
	</PRE>		</PRE>
	===Spliter short remark===		===Spliter short remark===
		+	For better undestanding in is necessary to say few words about splitters.<BR>
	This splitter is very simple: each openstack log contains leading part '<number>', e.g. we can check all unique fields:		This splitter is very simple: each openstack log contains leading part '<number>', e.g. we can check all unique fields:
	<PRE>		<PRE>
Строка 179:		Строка 180:
	</PRE>		</PRE>

−	This number in log is PRI rsyslog field:	+	This number in log is PRI rsyslog field (injected by rsyslog logger):
	<BR>		<BR>
	{{quote\|		{{quote\|
	The PRI value is a combination of so-called severity and facility. The facility indicates where the message originated from (e.g. kernel, mail subsystem) while the severity provides a glimpse of how important the message might be (e.g. error or informational).}}		The PRI value is a combination of so-called severity and facility. The facility indicates where the message originated from (e.g. kernel, mail subsystem) while the severity provides a glimpse of how important the message might be (e.g. error or informational).}}
		+
−	and added into message template:
		+	Log message template in rsyslog configuration:
	<PRE>		<PRE>
	$Template RemoteLog, "<%pri%>%timestamp% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n"		$Template RemoteLog, "<%pri%>%timestamp% %hostname% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n"
	</PRE>		</PRE>
		+
		+	So all messages comes via system logging (provided by rsyslog in MOS) are having <PRI> prefix

Sirmax: /* LogstreamerInput */

2016-01-31T15:34:59Z

LogstreamerInput

← Предыдущая		Версия 15:34, 31 января 2016
Строка 110:		Строка 110:
	* logstreamer-swift.toml		* logstreamer-swift.toml
	* logstreamer-system.toml		* logstreamer-system.toml
		+	===Logstream input explanation===
	All logstream inputs are very closed to each other. E.g logstreamer-openstack:		All logstream inputs are very closed to each other. E.g logstreamer-openstack:
	<PRE>		<PRE>

Sirmax: /* LogstreamerInput */

2016-01-31T15:34:16Z

LogstreamerInput

← Предыдущая		Версия 15:34, 31 января 2016
Строка 160:		Строка 160:
	delimiter_eol = false		delimiter_eol = false
	</PRE>		</PRE>
		+	===Spliter short remark===
	This splitter is very simple: each openstack log contains leading part '<number>', e.g. we can check all unique fields:		This splitter is very simple: each openstack log contains leading part '<number>', e.g. we can check all unique fields:
	<PRE>		<PRE>