I am trying to use logstash to input weblogic log servers, and output them to a rsyslog server using output syslog
Here is my logstash conf:
input {
file {
path => "/u01/app/oracle/middleware/user_projects/domains/base_domain/servers/AdminServer/logs/AdminServer.*"
type => "weblogic"
}
}
filter {
date {
}
}
output {
syslog {
Print each event to stdout.
appname => WEBLOGIC
facility => local7
host => "syslog.host.com"
port => 514
protocol => udp
severity => debug
sourcehost => nooslux750t
}
}
Here is a typical line from the log I am trying to parse
####<24.sep.2013 kl 12.59 CEST> <Notice> <Log Management> <nooslux750t.wwl.2wglobal.com> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1380020383684> <BEA-170027> <The Server has established connection with the Domain level Diagnostic Service successfully.>
So when I start logstasher, the follwing error is displayed:
Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (ArgumentError) invalid date
at RUBY.new_by_frags(jar:file:/opt/logstash/logstash-1.2.1-flatjar.jar!/META-INF/jruby.home/lib/ruby/1.9/date.rb:1691)
at RUBY.iso8601(jar:file:/opt/logstash/logstash-1.2.1-flatjar.jar!/META-INF/jruby.home/lib/ruby/1.9/date.rb:1741)
at RUBY.receive(file:/opt/logstash/logstash-1.2.1-flatjar.jar!/logstash/outputs/syslog.rb:125)
at RUBY.initialize((eval):35)
at org.jruby.RubyProc.call(org/jruby/RubyProc.java:255)
at RUBY.output(file:/opt/logstash/logstash-1.2.1-flatjar.jar!/logstash/pipeline.rb:247)
at RUBY.outputworker(file:/opt/logstash/logstash-1.2.1-flatjar.jar!/logstash/pipeline.rb:212)
at RUBY.start_outputs(file:/opt/logstash/logstash-1.2.1-flatjar.jar!/logstash/pipeline.rb:140)
This is the same problem as in LOGSTASH-1423.
I created a pull request to fix this.
PR resolved as a solution was merged in