NAgioslogserver2 Upgrade from 1.4.1 - Elapsed plugin

[saleemthupsee]

Hello,

I upgraded NagiosLogserver 1.41 to 2.02. I found out that the elapsed plugin field has changed from elapsed.time to elapsed_time. I changed this and applied configuration directly and it seems to work. However when i go through verify and apply configuration in the global config section, the elapsed_time changes to the follwing "%0.2120" in the filter and output.

Is there a fix if i do big changes and need to verify ?

regards,
Saleem
Paris

[cdienger]

I haven't been able to reproduce this. Can you post or PM me your logstash config and screenshots showing the problem? Also, looking at https://www.elastic.co/guide/en/logstas ... apsed.html it still looks like elapsed.time would be used so please help me understand where you see elapsed_time should be used instead.

[saleemthupsee]

Actually, elapsed.time shows up as a field name "elapsed_time" in the nagioslogserver 2.0.2. It was showing up as a field named elapsed.time in nagioslogserver 1.4.1

Saleem
PAris
France

[scottwilkerson]

Not really sure how you have the underscore version, both versions of the plugin I can see show elapsed.time

Old version in Nagios Log Server
https://www.elastic.co/guide/en/logstas ... apsed.html

New version in Nagios Log Server
https://www.elastic.co/guide/en/logstas ... apsed.html

Could you share your logstash configurations? Maybe there is something renaming the filed.

[saleemthupsee]

Hi Scott,

Attached are the logstash config and the screen shots. I am finishing the contract in 2 weeks and hope to get this fixed. Otherwise the boss will have to go and change all the elapsed_time field in case he changes any logstash configuration. This is the dilema i am in now, each time i update the logstash code, all fields containing elapsed_time have to be set from %0.4409 to %{elapsed_time}. It does work, but is painful.

pipe {
command => "curl -k -X POST -L 'https://192.168.97.2/nrdp?cmd=submitcmd ... %{pid_desc}''"
}

[scottwilkerson]

I searched the code for the plugin and despite the documentation saying it is separated with a . I can see the authors migrated to using the underscore.

Further investigation shows the commit here
https://github.com/logstash-plugins/log ... d946b635df

And the discussion the precipitated the change:
https://discuss.elastic.co/t/field-name ... in/33251/5

Sorry for the trouble but it looks like with that plugin the _ is the way it is going to be for a long time to come.

Wish I had different news and we were able to warn about this in advance.

[saleemthupsee]

Thanks Scott. I am implementing my code otherwise in the filter section to go around the issue of elapsed_time issue being translated to a %4563 numeric variable. It works on a first applyconfiguration. On any susbsequent apply of configuration the elapsed_time variable remains in %4563 and does replace the contents of the variable.

So I will gather the elapsed.time in the filter section in a seperate field so that I have to change it in one location on any subsequent changes to the logstash configuration.

Will this issue be fixed in a subsequent release ?


Saleem
Paris
France

[scottwilkerson]

I am implementing my code otherwise in the filter section to go around the issue of elapsed_time issue being translated to a %4563 numeric variable. It works on a first applyconfiguration. On any susbsequent apply of configuration the elapsed_time variable remains in %4563 and does replace the contents of the variable.

I am not familiar with what you mean by this.

Could you post the filter section that is causing the problem?