Help needed for Weblogic app log monitoring by logstash
Description
Gliffy Diagrams
Activity
Philippe Weber October 31, 2013 at 10:06 AM
Closing old support ticket for new comer,
questions present here should be already answered as part of the getting started guide in the logstash current documentation
http://logstash.net/docs/1.2.2/
Please open new support question if something is still not clear
Faruk April 12, 2013 at 4:22 PM
Notice on thing that the file I was to monitor is copied file from an application server. Another word, that file no longer grow. I don't if that has to do anything with process PID being killed.
2nd thing, What do we do to hve logstash to monitor live application log file from web server to application server. Our web and app servers are separate physical server. Is there any configuration we need to setup to do that for LOGSTASH?
Faruk April 12, 2013 at 3:50 PM
Hi, I just added the -v with agent and ran the logstash.
Here is the log it generated but still PID got killed.
jar:file:/export/netsite/http-default/docs/logstash/logstash-1.1.9-monolithic.jar!/gems/json-1.7.6-java/lib/json/common.rb:102 warning: already initialized constant Infinity
jar:file:/export/netsite/http-default/docs/logstash/logstash-1.1.9-monolithic.jar!/gems/json-1.7.6-java/lib/json/common.rb:104 warning: already initialized constant MinusInfinity
jar:file:/export/netsite/http-default/docs/logstash/logstash-1.1.9-monolithic.jar!/gems/json-1.7.6-java/lib/json/common.rb:129 warning: already initialized constant UnparserError
{:message=>"New ElasticSearch output", :cluster=>nil, :host=>"localhost", ort=>9300, :embedded=>true, :level=>:info}
I don't see any log on this logging file. I don't see the PID being running on the PS. Please let me know what I need to do. I am little bit frustrated here.
Philippe Weber April 12, 2013 at 6:28 AM
This json stuff is only a warning. The real strange stuff is the process being killed.
Can you add -v in the agent params into your script and attach the resulting log file
Faruk April 11, 2013 at 3:40 PM
Hi,
I did change it the logstash.conf file to include the elasticsearch. I still get error and the job got killed automatically. Am I missing any pacakges: See my conf and error:
CONF:
input {
stdin {
type => "stdin-type"
}
file {
type => "weblogic-log"
path => [ "/export/bea/logs/Mah-ias/fgvws_bedlam5_s2.start" ]
}
}
output {
stdout { }
elasticsearch { embedded => true }
}
ERROR:
jar:file:/export/netsite/http-default/docs/logstash/logstash-1.1.9-monolithic.jar!/gems/json-1.7.6-java/lib/json/common.rb:129 warning: already
initialized constant UnparserError
My logstash.conf file is:
input {
stdin {
type => "stdin-type"
}
file {
type => "weblogic-log"
path => [ "/export/bea/logs/Mah-ias/fgvws_bedlam5_s2.start" ]
}
}
output {
enable stdout for debug purposes only
stdout { }
#
elasticsearch {
host => "localhost"
}
}
When I ran the logstash, I get following on the log:
Java::OrgElasticsearchClusterBlock::ClusterBlockException - blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];[SERVICE_UNAVA
ILABLE/2/no master];:
org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedException(ClusterBlocks.java:138)
org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedRaiseException(ClusterBlocks.java:128)
org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.<init>(TransportSearchTypeAction.java:109)
org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.<init>(TransportSearchQueryThenFetchAction.java:70)
org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.<init>(TransportSearchQueryThenFetchAction.java:61)
org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction.doExecute(TransportSearchQueryThenFetchAction.java:58)
org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction.doExecute(TransportSearchQueryThenFetchAction.java:48)
org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:61)
==================================
On the web interface http://localhost:9292, I search a word but it gives me following:
Java::OrgElasticsearchClusterBlock::ClusterBlockException at /search
blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];[SERVICE_UNAVAILABLE/2/no master];
Ruby org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedException(ClusterBlocks.java: in nil, line 138
Web GET 10.245.14.178/search
Jump to:
GET POST Cookies ENV Traceback (innermost first)
org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedException(ClusterBlocks.java: in nil
org.elasticsearch.cluster.block.ClusterBlocks.globalBlockedRaiseException(ClusterBlocks.java: in nil
org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.<init>(TransportSearchTypeAction.java: in nil
org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.<init>(TransportSearchQueryThenFetchAction
I don't know what I am doing wrong here??