Somehow the events shipped by lumberjack seems to be agitated in a weird way.
I have logs from logfile1 tagged with the type of logfile2.
lumberjack-configuration:
In LS i have entries matching type "syslog", but the events come from "/var/log/snoopy.log". I can't find the events in "snoopy.log", because they are only located in "/var/log/messages". o.O
In the shipper config there are only filters with matching type => "syslog" or type => "shell-audit". No replacements, or something else.
This happens since the installation of LS 1.2.0
You can grep for 'inventory' to get the weird events.
Another two examples:
1) http://pastebin.com/hPjWYgaR
2) http://pastebin.com/G0J382kQ
Both events came from audit.log but "file" is at 1) snoopy.log, at 2) messages. I've checked both, snoopy.log and messages... no entries.
I've just downgraded to LS 1.1.13 and the error is gone.
For 1.2.1 it's still open.
Is this still an issue in 1.3.x?
A little more aggressive garbage-collect on jira.com, expecting follow-up activities to take place on github issues