Nagios Log Server - Updating Logstash Patterns

Overview

This article shows you how to update the Logstash patterns on Nagios Log Server. This might resolve issues with logs not being parsed which can lead to a _grokparsefailure.

Instructions

Open an SSH session to a Nagios Log Server node.

Type:

cd /usr/local/nagioslogserver/logstash/bin
./plugin update logstash-patterns-core

Which should give you an output like:

Updating logstash-patterns-core
Updated logstash-patterns-core 0.1.10 to 0.4.0

You will need to perform this on all of your Nagios Log Server nodes.

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/