Nagios Support Forum

mbeebe wrote:

mbellerue wrote:Alright, one more thing we should try is using a template that just has the %last10alertlogs% macro in it. Just in case one of the other macros is somehow conflicting with that macro. Then also a template with just %lastalertlog%.

Ok -- I'll give that a try. Thanks.

No luck:

The template is just %lastalertlog% and the result is:


@timestamp 2019-12-30T18:25:47.748Z
message
@version 1
tags
host xx.xx.xx.xx
port xxxxx
type xxxxx_multiline
alert_names

I'd like to get on the latest version of Log Server, and then get as close as possible to identical messages, inputs, and filters as you have. Is upgrading to 2.1.3 an option?

mbellerue wrote:I'd like to get on the latest version of Log Server, and then get as close as possible to identical messages, inputs, and filters as you have. Is upgrading to 2.1.3 an option?

So here's the good news: I managed to get this to work. I had to disable the filter for the log we're parsing, but now it works.

Here's the bad news: This still doesn't resolve this issue: https://support.nagios.com/forum/viewto ... 38&t=56743
The message body doesn't appear in the Nagios alerts, only on the messages sent from the log server.

Progress is progress, however.

-- Mike Beebe

Are you good with disabling the filter as the solution to this? If so, I'll close this thread, and we can continue work on the other issue.

mbellerue wrote:Are you good with disabling the filter as the solution to this? If so, I'll close this thread, and we can continue work on the other issue.

Yeah, that works for me -- go ahead and lock.

Locking!