Events shipped by lumberjack are agitated

Description

Somehow the events shipped by lumberjack seems to be agitated in a weird way.

I have logs from logfile1 tagged with the type of logfile2.

lumberjack-configuration:

In LS i have entries matching type "syslog", but the events come from "/var/log/snoopy.log". I can't find the events in "snoopy.log", because they are only located in "/var/log/messages". o.O

In the shipper config there are only filters with matching type => "syslog" or type => "shell-audit". No replacements, or something else.

This happens since the installation of LS 1.2.0

Activity

Show:
Tobias Wolf
September 4, 2013, 12:02 PM

You can grep for 'inventory' to get the weird events.

Tobias Wolf
September 6, 2013, 3:12 PM

Another two examples:

1) http://pastebin.com/hPjWYgaR

2) http://pastebin.com/G0J382kQ

Both events came from audit.log but "file" is at 1) snoopy.log, at 2) messages. I've checked both, snoopy.log and messages... no entries.

Tobias Wolf
September 12, 2013, 8:50 PM

I've just downgraded to LS 1.1.13 and the error is gone.

For 1.2.1 it's still open.

Jason Kendall
March 6, 2014, 4:11 PM

Is this still an issue in 1.3.x?

Philippe Weber
August 4, 2014, 10:36 AM

A little more aggressive garbage-collect on jira.com, expecting follow-up activities to take place on github issues

REJECTED

Assignee

Logstash Developers

Reporter

Tobias Wolf

Labels

None

Affects versions

Configure