Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-09-20 00:06:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

debugd: Use very basic JSON regex filter before JSON filter

Browse Source
This commit is contained in:
Nils Hanke 2023-03-20 11:33:51 +01:00 committed by Nils Hanke
parent 6f16e0b6fd
commit 3fceb2207d
1 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
debugd/internal/debugd/logcollector/logstash/templates/pipeline.conf
View File

@ -28,25 +28,31 @@ filter {
# Parse structured logs for following systemd units. # Parse structured logs for following systemd units.
if [systemd][unit] in ["bootstrapper.service", "constellation-bootstrapper.service"] { if [systemd][unit] in ["bootstrapper.service", "constellation-bootstrapper.service"] {
json { # skip_on_invalid_json below does not skip the whole filter, so let's use a cheap workaround here.
source => "message" # See:
target => "logs" # https://discuss.elastic.co/t/skip-on-invalid-json-skipping-all-filters/215195
skip_on_invalid_json => true # https://discuss.elastic.co/t/looking-for-a-way-to-detect-json/102263
} if [message] =~ "\A\{.+\}\z" {
date { json {
match => [ "[logs][ts]", "ISO8601" ] source => "message"
} target => "logs"
mutate { skip_on_invalid_json => true
replace => { }
"message" => "%{[logs][msg]}" date {
match => [ "[logs][ts]", "ISO8601" ]
}
mutate {
replace => {
"message" => "%{[logs][msg]}"
}
remove_field => [
"[logs][msg]",
"[logs][ts]"
]
}
de_dot {
fields => ["[logs][peer.address]"]
} }
remove_field => [
"[logs][msg]",
"[logs][ts]"
]
}
de_dot {
fields => ["[logs][peer.address]"]
} }
} }
} }