apache events not shown in dashboard

This support forum board is for support questions relating to Nagios Log Server, our solution for managing and monitoring critical log data.
Locked
sams
Posts: 3
Joined: Thu Apr 27, 2017 5:38 am

apache events not shown in dashboard

Post by sams »

Hi
I am new to nagios log server platform, I am trying to deploy it to capture my apache web server events. I have configured the node(node01) running the apache instance into Nagios Log Server and the syslog of the node01 is visible on the dashboard.

But while trying to capture the apache events from the node01, I could not find the events in Dashboard though.

I ran the below command to capture apache events. Is there any log files that I can refer to troubleshoot.

bash setup-linux.sh -s 100.60.12.10 -p 5544 -f "/var/log/apache2/error_log" -t apache_error sudo bash setup-linux.sh -s 100.60.12.10 -p 5544 -f "/var/log/apache2/access_log" -t apache_access

can someone help me on this please ?

Thanks,
Sam
Top
User avatar
mcapra
Posts: 3739
Joined: Thu May 05, 2016 3:54 pm

Re: apache events not shown in dashboard

Post by mcapra »

From the machine that is sending the Apache logs, can you share the output of:

Code: Select all

grep '' /etc/rsyslog.d/*
And from your Nagios Log Server machine, can you share the output of:

Code: Select all

grep '' /usr/local/nagioslogserver/logstash/etc/conf.d/*
tail -n 100 /var/log/logstash/logstash.log
Former Nagios employee
https://www.mcapra.com/
Top
sams
Posts: 3
Joined: Thu Apr 27, 2017 5:38 am

Re: apache events not shown in dashboard

Post by sams »

Please find the output of rsyslog.conf and /etc/rsyslog.d/*

========================================================================================================

Code: Select all

root@logclient-ubuntu:~# grep -R '' /etc/rsyslog.conf /etc/rsyslog.d/
/etc/rsyslog.conf:#  /etc/rsyslog.conf  Configuration file for rsyslog.
/etc/rsyslog.conf:#
/etc/rsyslog.conf:#                     For more information see
/etc/rsyslog.conf:#                     /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html
/etc/rsyslog.conf:#
/etc/rsyslog.conf:#  Default logging rules can be found in /etc/rsyslog.d/50-default.conf
/etc/rsyslog.conf:
/etc/rsyslog.conf:
/etc/rsyslog.conf:#################
/etc/rsyslog.conf:#### MODULES ####
/etc/rsyslog.conf:#################
/etc/rsyslog.conf:
/etc/rsyslog.conf:$ModLoad imuxsock # provides support for local system logging
/etc/rsyslog.conf:$ModLoad imklog   # provides kernel logging support
/etc/rsyslog.conf:#$ModLoad immark  # provides --MARK-- message capability
/etc/rsyslog.conf:
/etc/rsyslog.conf:# provides UDP syslog reception
/etc/rsyslog.conf:#$ModLoad imudp
/etc/rsyslog.conf:#$UDPServerRun 514
/etc/rsyslog.conf:
/etc/rsyslog.conf:# provides TCP syslog reception
/etc/rsyslog.conf:#$ModLoad imtcp
/etc/rsyslog.conf:#$InputTCPServerRun 514
/etc/rsyslog.conf:
/etc/rsyslog.conf:# Enable non-kernel facility klog messages
/etc/rsyslog.conf:$KLogPermitNonKernelFacility on
/etc/rsyslog.conf:
/etc/rsyslog.conf:###########################
/etc/rsyslog.conf:#### GLOBAL DIRECTIVES ####
/etc/rsyslog.conf:###########################
/etc/rsyslog.conf:
/etc/rsyslog.conf:#
/etc/rsyslog.conf:# Use traditional timestamp format.
/etc/rsyslog.conf:# To enable high precision timestamps, comment out the following line.
/etc/rsyslog.conf:#
/etc/rsyslog.conf:$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
/etc/rsyslog.conf:
/etc/rsyslog.conf:# Filter duplicated messages
/etc/rsyslog.conf:$RepeatedMsgReduction on
/etc/rsyslog.conf:
/etc/rsyslog.conf:#
/etc/rsyslog.conf:# Set the default permissions for all log files.
/etc/rsyslog.conf:#
/etc/rsyslog.conf:$FileOwner syslog
/etc/rsyslog.conf:$FileGroup adm
/etc/rsyslog.conf:$FileCreateMode 0640
/etc/rsyslog.conf:$DirCreateMode 0755
/etc/rsyslog.conf:$Umask 0022
/etc/rsyslog.conf:$PrivDropToUser syslog
/etc/rsyslog.conf:$PrivDropToGroup syslog
/etc/rsyslog.conf:
/etc/rsyslog.conf:#
/etc/rsyslog.conf:# Where to place spool and state files
/etc/rsyslog.conf:#
/etc/rsyslog.conf:$WorkDirectory /var/spool/rsyslog
/etc/rsyslog.conf:
/etc/rsyslog.conf:#
/etc/rsyslog.conf:# Include all config files in /etc/rsyslog.d/
/etc/rsyslog.conf:#
/etc/rsyslog.conf:$IncludeConfig /etc/rsyslog.d/*.conf
/etc/rsyslog.conf:
/etc/rsyslog.d/20-ufw.conf:# Log kernel generated UFW log messages to file
/etc/rsyslog.d/20-ufw.conf::msg,contains,"[UFW " /var/log/ufw.log
/etc/rsyslog.d/20-ufw.conf:
/etc/rsyslog.d/20-ufw.conf:# Uncomment the following to stop logging anything that matches the last rule.
/etc/rsyslog.d/20-ufw.conf:# Doing this will stop logging kernel generated UFW log messages to the file
/etc/rsyslog.d/20-ufw.conf:# normally containing kern.* messages (eg, /var/log/kern.log)
/etc/rsyslog.d/20-ufw.conf:#& ~
/etc/rsyslog.d/99-nagioslogserver.conf:### Begin forwarding rule for Nagios Log Server                           NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$WorkDirectory /var/spool/rsyslog # Where spool files will live             NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files     NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueMaxDiskSpace 1g   # 1GB space limit (use as much as possible) NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown         NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueType LinkedList   # Use asynchronous processing               NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionResumeRetryCount -1    # Infinite retries if host is down          NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:# Remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional       NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:*.* @@100.64.7.247:5544                                               # NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:### End of Nagios Log Server forwarding rule                              NAGIOSLOGSERVER
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$ModLoad imfile
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFilePollInterval 10
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$PrivDropToGroup adm
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$WorkDirectory /var/spool/rsyslog
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# Input for apache_error
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFileName /var/log/apache2/error_log
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFileTag apache_error:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFileStateFile nls-state-var_log_apache2_error_log # Must be unique for each file being polled
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# Uncomment the folowing line to override the default severity for messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# from this file.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:#$InputFileSeverity info
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFilePersistStateInterval 20000
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputRunFileMonitor
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# Forward to Nagios Log Server and then discard, otherwise these messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# will end up in the syslog file (/var/log/messages) unless there are other
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# overriding rules.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:if $programname == 'apache_error' then @@100.64.7.247:5544
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:if $programname == 'apache_error' then ~
/etc/rsyslog.d/50-default.conf:#  Default rules for rsyslog.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#                        For more information see rsyslog.conf(5) and /etc/rsyslog.conf
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# First some standard log files.  Log by facility.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:auth,authpriv.*                  /var/log/auth.log
/etc/rsyslog.d/50-default.conf:*.*;auth,authpriv.none           -/var/log/syslog
/etc/rsyslog.d/50-default.conf:#cron.*                          /var/log/cron.log
/etc/rsyslog.d/50-default.conf:#daemon.*                        -/var/log/daemon.log
/etc/rsyslog.d/50-default.conf:kern.*                           -/var/log/kern.log
/etc/rsyslog.d/50-default.conf:#lpr.*                           -/var/log/lpr.log
/etc/rsyslog.d/50-default.conf:mail.*                           -/var/log/mail.log
/etc/rsyslog.d/50-default.conf:#user.*                          -/var/log/user.log
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Logging for the mail system.  Split it up so that
/etc/rsyslog.d/50-default.conf:# it is easy to write scripts to parse these files.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#mail.info                       -/var/log/mail.info
/etc/rsyslog.d/50-default.conf:#mail.warn                       -/var/log/mail.warn
/etc/rsyslog.d/50-default.conf:mail.err                 /var/log/mail.err
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Logging for INN news system.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:news.crit                        /var/log/news/news.crit
/etc/rsyslog.d/50-default.conf:news.err                 /var/log/news/news.err
/etc/rsyslog.d/50-default.conf:news.notice                      -/var/log/news/news.notice
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Some "catch-all" log files.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#*.=debug;\
/etc/rsyslog.d/50-default.conf:#        auth,authpriv.none;\
/etc/rsyslog.d/50-default.conf:#        news.none;mail.none     -/var/log/debug
/etc/rsyslog.d/50-default.conf:#*.=info;*.=notice;*.=warn;\
/etc/rsyslog.d/50-default.conf:#        auth,authpriv.none;\
/etc/rsyslog.d/50-default.conf:#        cron,daemon.none;\
/etc/rsyslog.d/50-default.conf:#        mail,news.none          -/var/log/messages
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Emergencies are sent to everybody logged in.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:*.emerg                                :omusrmsg:*
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# I like to have messages displayed on the console, but only on a virtual
/etc/rsyslog.d/50-default.conf:# console I usually leave idle.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#daemon,mail.*;\
/etc/rsyslog.d/50-default.conf:#        news.=crit;news.=err;news.=notice;\
/etc/rsyslog.d/50-default.conf:#        *.=debug;*.=info;\
/etc/rsyslog.d/50-default.conf:#        *.=notice;*.=warn       /dev/tty8
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
/etc/rsyslog.d/50-default.conf:# you must invoke `xconsole' with the `-file' option:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#    $ xconsole -file /dev/xconsole [...]
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
/etc/rsyslog.d/50-default.conf:#      busy site..
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:daemon.*;mail.*;\
/etc/rsyslog.d/50-default.conf: news.err;\
/etc/rsyslog.d/50-default.conf: *.=debug;*.=info;\
/etc/rsyslog.d/50-default.conf: *.=notice;*.=warn       |/dev/xconsole
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$ModLoad imfile
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFilePollInterval 10
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$PrivDropToGroup adm
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$WorkDirectory /var/spool/rsyslog
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# Input for apache_access
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFileName /var/log/apache2/access_log
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFileTag apache_access:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFileStateFile nls-state-var_log_apache2_access_log # Must be unique for each file being polled
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# Uncomment the folowing line to override the default severity for messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# from this file.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:#$InputFileSeverity info
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFilePersistStateInterval 20000
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputRunFileMonitor
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# Forward to Nagios Log Server and then discard, otherwise these messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# will end up in the syslog file (/var/log/messages) unless there are other
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# overriding rules.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:if $programname == 'apache_access' then @@100.64.7.247:5544
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:if $programname == 'apache_access' then ~
-===================================================================================================================================

Please find the output of grep '' /usr/local/nagioslogserver/logstash/etc/conf.d/*
=============================================================================================================================

Code: Select all

[root@localhost ~]# grep '' /usr/local/nagioslogserver/logstash/etc/conf.d/*
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Logstash Configuration File
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Dynamically created by Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Created Fri, 28 Apr 2017 15:58:49 +0530
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Global inputs
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:input {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    syslog {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'syslog'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 5544
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    tcp {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'eventlog'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 3515
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        codec => json {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:            charset => 'CP1252'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    tcp {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'import_raw'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        tags => 'import_raw'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 2056
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    tcp {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'import_json'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        tags => 'import_json'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 2057
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        codec => json
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    syslog {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'syslog'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 1514
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:}
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Local inputs
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Logstash Configuration File
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Dynamically created by Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Created Fri, 28 Apr 2017 15:58:49 +0530
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Global filters
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:filter {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    if [program] == 'apache_access' {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        grok {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            match => [ 'message', '%{COMBINEDAPACHELOG}']
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        date {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z', 'MMM dd HH:mm:ss', 'ISO8601' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        mutate {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            replace => [ 'type', 'apache_access' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:             convert => [ 'bytes', 'integer' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:             convert => [ 'response', 'integer' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    if [program] == 'apache_error' {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        grok {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            match => [ 'message', '\[(?<timestamp>%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\] \[%{WORD:class}\] \[%{WORD:originator} %{IP:clientip}\] %{GREEDYDATA:errmsg}']
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        mutate {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            replace => [ 'type', 'apache_error' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:}
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Local filters
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Logstash Configuration File
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Dynamically created by Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Created Fri, 28 Apr 2017 15:58:49 +0530
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Required output for Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:output {
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:    elasticsearch {
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        cluster => '88a223d5-e335-4827-9768-fba2447c67f4'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        host => 'localhost'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        document_type => '%{type}'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        node_name => '3da95a48-7344-45b0-ab41-eab6d6fa3736'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        protocol => 'transport'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        workers => 4
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:}
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Global outputs
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Local outputs
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
================================================================================================================

Output of tail -n 100 /var/log/logstash/logstash.log

========================================================================================================

Code: Select all

ms/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.649000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.650000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.655000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.657000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.816000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.818000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:51.246000+0530", :message=>"SIGTERM received. Shutting down the pipeline.", :level=>:warn}
{:timestamp=>"2017-04-26T18:11:51.246000+0530", :message=>"SIGTERM received. Shutting down the pipeline.", :level=>:warn}
Last edited by tmcdonald on Wed May 03, 2017 9:17 am, edited 1 time in total.
Reason: Please use [code][/code] tags around long output
Top
sams
Posts: 3
Joined: Thu Apr 27, 2017 5:38 am

Re: apache events not shown in dashboard

Post by sams »

Code: Select all

sysuser@logclient-ubuntu:~$ grep '' /etc/rsyslog.d/*
/etc/rsyslog.d/20-ufw.conf:# Log kernel generated UFW log messages to file
/etc/rsyslog.d/20-ufw.conf::msg,contains,"[UFW " /var/log/ufw.log
/etc/rsyslog.d/20-ufw.conf:
/etc/rsyslog.d/20-ufw.conf:# Uncomment the following to stop logging anything that matches the last rule.
/etc/rsyslog.d/20-ufw.conf:# Doing this will stop logging kernel generated UFW log messages to the file
/etc/rsyslog.d/20-ufw.conf:# normally containing kern.* messages (eg, /var/log/kern.log)
/etc/rsyslog.d/20-ufw.conf:#& ~
/etc/rsyslog.d/50-default.conf:#  Default rules for rsyslog.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#                        For more information see rsyslog.conf(5) and /etc/rsyslog.conf
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# First some standard log files.  Log by facility.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:auth,authpriv.*                  /var/log/auth.log
/etc/rsyslog.d/50-default.conf:*.*;auth,authpriv.none           -/var/log/syslog
/etc/rsyslog.d/50-default.conf:#cron.*                          /var/log/cron.log
/etc/rsyslog.d/50-default.conf:#daemon.*                        -/var/log/daemon.log
/etc/rsyslog.d/50-default.conf:kern.*                           -/var/log/kern.log
/etc/rsyslog.d/50-default.conf:#lpr.*                           -/var/log/lpr.log
/etc/rsyslog.d/50-default.conf:mail.*                           -/var/log/mail.log
/etc/rsyslog.d/50-default.conf:#user.*                          -/var/log/user.log
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Logging for the mail system.  Split it up so that
/etc/rsyslog.d/50-default.conf:# it is easy to write scripts to parse these files.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#mail.info                       -/var/log/mail.info
/etc/rsyslog.d/50-default.conf:#mail.warn                       -/var/log/mail.warn
/etc/rsyslog.d/50-default.conf:mail.err                 /var/log/mail.err
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Logging for INN news system.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:news.crit                        /var/log/news/news.crit
/etc/rsyslog.d/50-default.conf:news.err                 /var/log/news/news.err
/etc/rsyslog.d/50-default.conf:news.notice                      -/var/log/news/news.notice
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Some "catch-all" log files.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#*.=debug;\
/etc/rsyslog.d/50-default.conf:#        auth,authpriv.none;\
/etc/rsyslog.d/50-default.conf:#        news.none;mail.none     -/var/log/debug
/etc/rsyslog.d/50-default.conf:#*.=info;*.=notice;*.=warn;\
/etc/rsyslog.d/50-default.conf:#        auth,authpriv.none;\
/etc/rsyslog.d/50-default.conf:#        cron,daemon.none;\
/etc/rsyslog.d/50-default.conf:#        mail,news.none          -/var/log/messages
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# Emergencies are sent to everybody logged in.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:*.emerg                                :omusrmsg:*
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# I like to have messages displayed on the console, but only on a virtual
/etc/rsyslog.d/50-default.conf:# console I usually leave idle.
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#daemon,mail.*;\
/etc/rsyslog.d/50-default.conf:#        news.=crit;news.=err;news.=notice;\
/etc/rsyslog.d/50-default.conf:#        *.=debug;*.=info;\
/etc/rsyslog.d/50-default.conf:#        *.=notice;*.=warn       /dev/tty8
/etc/rsyslog.d/50-default.conf:
/etc/rsyslog.d/50-default.conf:# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
/etc/rsyslog.d/50-default.conf:# you must invoke `xconsole' with the `-file' option:
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:#    $ xconsole -file /dev/xconsole [...]
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
/etc/rsyslog.d/50-default.conf:#      busy site..
/etc/rsyslog.d/50-default.conf:#
/etc/rsyslog.d/50-default.conf:daemon.*;mail.*;\
/etc/rsyslog.d/50-default.conf: news.err;\
/etc/rsyslog.d/50-default.conf: *.=debug;*.=info;\
/etc/rsyslog.d/50-default.conf: *.=notice;*.=warn       |/dev/xconsole
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$ModLoad imfile
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFilePollInterval 10
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$PrivDropToGroup adm
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$WorkDirectory /var/spool/rsyslog
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# Input for apache_access
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFileName /var/log/apache2/access_log
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFileTag apache_access:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFileStateFile nls-state-var_log_apache2_access_log # Must be unique for each file being polled
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# Uncomment the folowing line to override the default severity for messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# from this file.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:#$InputFileSeverity info
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputFilePersistStateInterval 20000
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:$InputRunFileMonitor
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# Forward to Nagios Log Server and then discard, otherwise these messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# will end up in the syslog file (/var/log/messages) unless there are other
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:# overriding rules.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:if $programname == 'apache_access' then @@100.64.7.247:5544
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_access_log.conf:if $programname == 'apache_access' then ~
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$ModLoad imfile
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFilePollInterval 10
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$PrivDropToGroup adm
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$WorkDirectory /var/spool/rsyslog
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# Input for apache_error
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFileName /var/log/apache2/error_log
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFileTag apache_error:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFileStateFile nls-state-var_log_apache2_error_log # Must be unique for each file being polled
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# Uncomment the folowing line to override the default severity for messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# from this file.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:#$InputFileSeverity info
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputFilePersistStateInterval 20000
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:$InputRunFileMonitor
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# Forward to Nagios Log Server and then discard, otherwise these messages
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# will end up in the syslog file (/var/log/messages) unless there are other
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:# overriding rules.
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:if $programname == 'apache_error' then @@100.64.7.247:5544
/etc/rsyslog.d/90-nagioslogserver_var_log_apache2_error_log.conf:if $programname == 'apache_error' then ~
/etc/rsyslog.d/99-nagioslogserver.conf:### Begin forwarding rule for Nagios Log Server                           NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$WorkDirectory /var/spool/rsyslog # Where spool files will live             NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueFileName nlsFwdRule0 # Unique name prefix for spool files     NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueMaxDiskSpace 1g   # 1GB space limit (use as much as possible) NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueSaveOnShutdown on # Save messages to disk on shutdown         NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionQueueType LinkedList   # Use asynchronous processing               NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:$ActionResumeRetryCount -1    # Infinite retries if host is down          NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:# Remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional       NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:*.* @@100.64.7.247:5544                                               # NAGIOSLOGSERVER
/etc/rsyslog.d/99-nagioslogserver.conf:### End of Nagios Log Server forwarding rule                              NAGIOSLOGSERVER

Code: Select all

[root@localhost logstash]# grep '' /usr/local/nagioslogserver/logstash/etc/conf.d/*
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Logstash Configuration File
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Dynamically created by Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Created Wed, 03 May 2017 13:29:26 +0530
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Global inputs
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:input {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    syslog {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'syslog'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 5544
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    tcp {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'eventlog'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 3515
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        codec => json {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:            charset => 'CP1252'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    tcp {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'import_raw'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        tags => 'import_raw'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 2056
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    tcp {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'import_json'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        tags => 'import_json'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 2057
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        codec => json
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    syslog {
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        type => 'syslog'
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:        port => 1514
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:}
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:# Local inputs
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/000_inputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Logstash Configuration File
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Dynamically created by Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Created Wed, 03 May 2017 13:29:26 +0530
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Global filters
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:filter {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    if [program] == 'apache_access' {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        grok {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            match => [ 'message', '%{COMBINEDAPACHELOG}']
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        date {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z', 'MMM dd HH:mm:ss', 'ISO8601' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        mutate {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            replace => [ 'type', 'apache_access' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:             convert => [ 'bytes', 'integer' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:             convert => [ 'response', 'integer' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    if [program] == 'apache_error' {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        grok {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            match => [ 'message', '\[(?<timestamp>%{DAY:day} %{MONTH:month} %{MONTHDAY} %{TIME} %{YEAR})\] \[%{WORD:class}\] \[%{WORD:originator} %{IP:clientip}\] %{GREEDYDATA:errmsg}']
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        mutate {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            replace => [ 'type', 'apache_error' ]
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    if [program] == 'apache_access' {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        geoip {
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:            source => 'clientip'
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:        }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:}
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:# Local filters
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/500_filters.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Logstash Configuration File
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Dynamically created by Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Created Wed, 03 May 2017 13:29:26 +0530
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Required output for Nagios Log Server
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:output {
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:    elasticsearch {
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        cluster => '88a223d5-e335-4827-9768-fba2447c67f4'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        host => 'localhost'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        document_type => '%{type}'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        node_name => '3da95a48-7344-45b0-ab41-eab6d6fa3736'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        protocol => 'transport'
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:        workers => 4
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:    }
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:}
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Global outputs
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:# Local outputs
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:#
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:
/usr/local/nagioslogserver/logstash/etc/conf.d/999_outputs.conf:


tail -n 100 /var/log/logstash/logstash.log


Code: Select all

{:timestamp=>"2017-04-26T18:11:49.814000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.479000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.481000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.649000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.650000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.655000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.657000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:50.816000+0530", :message=>"Got error to send bulk of actions: None of the configured nodes are available: []", :level=>:error}
{:timestamp=>"2017-04-26T18:11:50.818000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: [], :backtrace=>["org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(org/elasticsearch/client/transport/TransportClientNodesService.java:279)", "org.elasticsearch.client.transport.TransportClientNodesService.execute(org/elasticsearch/client/transport/TransportClientNodesService.java:198)", "org.elasticsearch.client.transport.support.InternalTransportClient.execute(org/elasticsearch/client/transport/support/InternalTransportClient.java:106)", "org.elasticsearch.client.support.AbstractClient.bulk(org/elasticsearch/client/support/AbstractClient.java:163)", "org.elasticsearch.client.transport.TransportClient.bulk(org/elasticsearch/client/transport/TransportClient.java:356)", "org.elasticsearch.action.bulk.BulkRequestBuilder.doExecute(org/elasticsearch/action/bulk/BulkRequestBuilder.java:164)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:91)", "org.elasticsearch.action.ActionRequestBuilder.execute(org/elasticsearch/action/ActionRequestBuilder.java:65)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:606)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::Elasticsearch::Protocols::NodeClient.bulk(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch/protocol.rb:224)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:466)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.submit(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:465)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:490)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "LogStash::Outputs::ElasticSearch.flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:489)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:219)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1341)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:216)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_flush(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:193)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "Stud::Buffer.buffer_receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.19/lib/stud/buffer.rb:159)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::ElasticSearch.receive(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-0.2.8-java/lib/logstash/outputs/elasticsearch.rb:455)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "LogStash::Outputs::Base.handle(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:88)", "RUBY.worker_setup(/usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.1-java/lib/logstash/outputs/base.rb:79)", "java.lang.Thread.run(java/lang/Thread.java:745)"], :level=>:warn}
{:timestamp=>"2017-04-26T18:11:51.246000+0530", :message=>"SIGTERM received. Shutting down the pipeline.", :level=>:warn}
{:timestamp=>"2017-04-26T18:11:51.246000+0530", :message=>"SIGTERM received. Shutting down the pipeline.", :level=>:warn}
Last edited by tmcdonald on Wed May 03, 2017 9:21 am, edited 1 time in total.
Reason: Please use [code][/code] tags around long output
Top
User avatar
mcapra
Posts: 3739
Joined: Thu May 05, 2016 3:54 pm

Re: apache events not shown in dashboard

Post by mcapra »

Here's something worth mentioning:

Code: Select all

{:timestamp=>"2017-04-26T18:11:49.814000+0530", :message=>"Failed to flush outgoing items", :outgoing_count=>1, :exception=>org.elasticsearch.client.transport.NoNodeAvailableException: None of the configured nodes are available: []
It doesn't look like Logstash is able to reach the Elasticsearch cluster. Granted those entries are a bit old (from the 26th of April), they may be indicative of some problems. Is Logstash currently running on the Nagios Log Server machine? What is the output of:

Code: Select all

service logstash status
Can you also share the complete Elasticsearch logs? They can be found in this path:

Code: Select all

/var/log/elasticsearch
Former Nagios employee
https://www.mcapra.com/
Top
Locked

Return to “Nagios Log Server”