Search found 91 matches
- Fri Jan 06, 2017 8:13 am
- Forum: Nagios Log Server
- Topic: output: how to select index?
- Replies: 2
- Views: 776
Re: output: how to select index?
I tried to use following output configuration: if [type] == 'metricbeat' or [LogFile] == 'metricbeat' { elasticsearch { cluster => 'ff0eeea9-743f-4dd8-b088-ae81fcee793a' host => 'localhost' document_type => '%{type}' node_name => '931e8fa4-a75f-4be1-ada5-bc71520c4ede' protocol => 'transport' workers...
- Fri Jan 06, 2017 6:15 am
- Forum: Nagios Log Server
- Topic: output: how to select index?
- Replies: 2
- Views: 776
output: how to select index?
Hi, Background: Our logstash index is currently up to 10GB per day. We are using a single instance. We have different retention intervals per logfile - that means log 1 a we need to keep a month, log 2 we sould keep for the last 3 month as example. Logs from dev systems may be deleted after 2 weeks,...
- Mon Dec 05, 2016 4:46 am
- Forum: Nagios Log Server
- Topic: All shards failed for phase: [query_fetch]
- Replies: 8
- Views: 1486
Re: All shards failed for phase: [query_fetch]
after rebooting the whole server logserver webfrontent is available again. But that is not a solution. 1. What can we do to identify the root cause? - during the weekend log processing stopped suddenly - after restarting logstash and elasticsearch this morning, the log processing started to work aga...
- Mon Dec 05, 2016 4:23 am
- Forum: Nagios Log Server
- Topic: All shards failed for phase: [query_fetch]
- Replies: 8
- Views: 1486
Re: All shards failed for phase: [query_fetch]
seems to be a frontend problem. after restarting logstash again, I can see high cpu usage on logstash and some cpu on elasticsearch top - 10:19:55 up 21 days, 23:07, 3 users, load average: 1.55, 2.75, 1.69 Tasks: 251 total, 1 running, 250 sleeping, 0 stopped, 0 zombie Cpu(s): 1.8%us, 0.6%sy, 62.7%ni...
- Mon Dec 05, 2016 4:14 am
- Forum: Nagios Log Server
- Topic: All shards failed for phase: [query_fetch]
- Replies: 8
- Views: 1486
Re: All shards failed for phase: [query_fetch]
restarting httpd does not help anything.
- Mon Dec 05, 2016 4:05 am
- Forum: Nagios Log Server
- Topic: All shards failed for phase: [query_fetch]
- Replies: 8
- Views: 1486
Re: All shards failed for phase: [query_fetch]
additionally I requested the shard overview some seconds later: logstash-2016.11.05 2 p STARTED 497391 392.9mb 127.0.0.1 f12d79cf-a699-42b8-b6c2-47d36407ac87 logstash-2016.11.05 2 r UNASSIGNED logstash-2016.11.05 0 p STARTED 497375 391.4mb 127.0.0.1 f12d79cf-a699-42b8-b6c2-47d36407ac87 logstash-2016...
- Mon Dec 05, 2016 4:02 am
- Forum: Nagios Log Server
- Topic: All shards failed for phase: [query_fetch]
- Replies: 8
- Views: 1486
Re: All shards failed for phase: [query_fetch]
Hi, today we are facing the same problem again. Accessing logservers webpage throws http 503. restarting elasticsearch (logstash still stopped) doesn't help. 503 stays. here is the log of elasticsearch after startup: [2016-12-05 09:43:27,781][INFO ][node ] [f12d79cf-a699-42b8-b6c2-47d36407ac87] vers...
- Thu Nov 24, 2016 1:47 pm
- Forum: Nagios Log Server
- Topic: verify config / apply config sometimes not returning
- Replies: 5
- Views: 734
Re: verify config / apply config sometimes not returning
Here is what you wanted: # tail -f /usr/local/nagioslogserver/var/jobs.log Running command delete_snapshot with args 'a:1:{s:4:"path";s:75:"/usr/local/nagioslogserver/snapshots/applyconfig.snapshot.1480012681.tar.gz";}' for job id: AViXpmzBX8Pxd4A2tYTo SUCCESS Running command app...
- Wed Nov 23, 2016 2:59 pm
- Forum: Nagios Log Server
- Topic: nxlog: bug with SavePos on files > 4GB?
- Replies: 4
- Views: 672
Re: nxlog: bug with SavePos on files > 4GB?
yes, exactly. Thanks
- Wed Nov 23, 2016 2:48 pm
- Forum: Nagios Log Server
- Topic: nxlog: bug with SavePos on files > 4GB?
- Replies: 4
- Views: 672
nxlog: bug with SavePos on files > 4GB?
Hi, I have some logfiles which will be 5 to 6 GB at the end of day. When I restarted nxlog in the evening, one log was not resumed correctly. It has been reloaded from 7 o clock. Size at 7 o clock may be at about 1GB. So I needed to delete the cache to continue normally. I assume that there is an in...