Search found 91 matches

by _asp_
Fri Jan 06, 2017 8:13 am
Forum: Nagios Log Server
Topic: output: how to select index?
Replies: 2
Views: 776

Re: output: how to select index?

I tried to use following output configuration: if [type] == 'metricbeat' or [LogFile] == 'metricbeat' { elasticsearch { cluster => 'ff0eeea9-743f-4dd8-b088-ae81fcee793a' host => 'localhost' document_type => '%{type}' node_name => '931e8fa4-a75f-4be1-ada5-bc71520c4ede' protocol => 'transport' workers...
by _asp_
Fri Jan 06, 2017 6:15 am
Forum: Nagios Log Server
Topic: output: how to select index?
Replies: 2
Views: 776

output: how to select index?

Hi, Background: Our logstash index is currently up to 10GB per day. We are using a single instance. We have different retention intervals per logfile - that means log 1 a we need to keep a month, log 2 we sould keep for the last 3 month as example. Logs from dev systems may be deleted after 2 weeks,...
by _asp_
Mon Dec 05, 2016 4:46 am
Forum: Nagios Log Server
Topic: All shards failed for phase: [query_fetch]
Replies: 8
Views: 1486

Re: All shards failed for phase: [query_fetch]

after rebooting the whole server logserver webfrontent is available again. But that is not a solution. 1. What can we do to identify the root cause? - during the weekend log processing stopped suddenly - after restarting logstash and elasticsearch this morning, the log processing started to work aga...
by _asp_
Mon Dec 05, 2016 4:23 am
Forum: Nagios Log Server
Topic: All shards failed for phase: [query_fetch]
Replies: 8
Views: 1486

Re: All shards failed for phase: [query_fetch]

seems to be a frontend problem. after restarting logstash again, I can see high cpu usage on logstash and some cpu on elasticsearch top - 10:19:55 up 21 days, 23:07, 3 users, load average: 1.55, 2.75, 1.69 Tasks: 251 total, 1 running, 250 sleeping, 0 stopped, 0 zombie Cpu(s): 1.8%us, 0.6%sy, 62.7%ni...
by _asp_
Mon Dec 05, 2016 4:14 am
Forum: Nagios Log Server
Topic: All shards failed for phase: [query_fetch]
Replies: 8
Views: 1486

Re: All shards failed for phase: [query_fetch]

restarting httpd does not help anything.
by _asp_
Mon Dec 05, 2016 4:05 am
Forum: Nagios Log Server
Topic: All shards failed for phase: [query_fetch]
Replies: 8
Views: 1486

Re: All shards failed for phase: [query_fetch]

additionally I requested the shard overview some seconds later: logstash-2016.11.05 2 p STARTED 497391 392.9mb 127.0.0.1 f12d79cf-a699-42b8-b6c2-47d36407ac87 logstash-2016.11.05 2 r UNASSIGNED logstash-2016.11.05 0 p STARTED 497375 391.4mb 127.0.0.1 f12d79cf-a699-42b8-b6c2-47d36407ac87 logstash-2016...
by _asp_
Mon Dec 05, 2016 4:02 am
Forum: Nagios Log Server
Topic: All shards failed for phase: [query_fetch]
Replies: 8
Views: 1486

Re: All shards failed for phase: [query_fetch]

Hi, today we are facing the same problem again. Accessing logservers webpage throws http 503. restarting elasticsearch (logstash still stopped) doesn't help. 503 stays. here is the log of elasticsearch after startup: [2016-12-05 09:43:27,781][INFO ][node ] [f12d79cf-a699-42b8-b6c2-47d36407ac87] vers...
by _asp_
Thu Nov 24, 2016 1:47 pm
Forum: Nagios Log Server
Topic: verify config / apply config sometimes not returning
Replies: 5
Views: 734

Re: verify config / apply config sometimes not returning

Here is what you wanted: # tail -f /usr/local/nagioslogserver/var/jobs.log Running command delete_snapshot with args 'a:1:{s:4:"path";s:75:"/usr/local/nagioslogserver/snapshots/applyconfig.snapshot.1480012681.tar.gz";}' for job id: AViXpmzBX8Pxd4A2tYTo SUCCESS Running command app...
by _asp_
Wed Nov 23, 2016 2:59 pm
Forum: Nagios Log Server
Topic: nxlog: bug with SavePos on files > 4GB?
Replies: 4
Views: 672

Re: nxlog: bug with SavePos on files > 4GB?

yes, exactly. Thanks
by _asp_
Wed Nov 23, 2016 2:48 pm
Forum: Nagios Log Server
Topic: nxlog: bug with SavePos on files > 4GB?
Replies: 4
Views: 672

nxlog: bug with SavePos on files > 4GB?

Hi, I have some logfiles which will be 5 to 6 GB at the end of day. When I restarted nxlog in the evening, one log was not resumed correctly. It has been reloaded from 7 o clock. Size at 7 o clock may be at about 1GB. So I needed to delete the cache to continue normally. I assume that there is an in...