Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

REDISTIMESTAMP format is not matching in filebeat! #9819

Closed
longforfreedom opened this issue Dec 28, 2018 · 0 comments · Fixed by #10033
Closed

REDISTIMESTAMP format is not matching in filebeat! #9819

longforfreedom opened this issue Dec 28, 2018 · 0 comments · Fixed by #10033
Assignees
Labels
bug enhancement Filebeat Filebeat module Team:Integrations Label for the Integrations team

Comments

@longforfreedom
Copy link

longforfreedom commented Dec 28, 2018

Describe the enhancement:
Redis default log format like this
26571:M 27 Dec 2018 11:19:18.874 * Synchronization with replica 10.114.208.18:6023 succeeded
the timestamp format is dd MMM YYYY H:m:s.SSS , but in Elasticsearch pipeline "REDISTIMESTAMP" is "%{MONTHDAY} %{MONTH} %{TIME}"` and dd MMM YYYY H:m:s.SSS not in date.formats .

so, modify module/redis/log/ingest/pipeline.json

"pattern_definitions": {
    "CHAR": "[a-zA-Z]",
    "REDISLEVEL": "[.\\-*#]",
    "REDISTIMESTAMP": "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME}"
  }
  
"date": {
    "field": "redis.log.timestamp",
    "target_field": "@timestamp",
    "formats": [
      "dd MMM YYYY H:m:s.SSS",
      "dd MMM H:m:s",
      "UNIX"
    ],
    "ignore_failure": true
  }

in my case:

  • redis version is 5.0.3
  • elasticsearch version is 6.3.2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug enhancement Filebeat Filebeat module Team:Integrations Label for the Integrations team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants