Syslog - Parsing Message

1

Using Rsyslog and TICK to ingest Payara Server Logs. The format is ODL : Oracle Diagnostic Log Format ( Log Working Group in Oracle)

Example

[2 019-01-18T13:10:02.420+0100] [Payara 5.184] [INFO] [NCLS-LOGGING-00009] [javax.enterprise.logging] [tid: _ThreadID=31 _ThreadName=RunLevelControllerThread-1547813402253] [timeMillis: 1547813402420] [levelValue: 800] [[ Running Payara Version: Payara Server 5.184.1 #badassfish (build 90)]]

I am looking to count up WARNING or ERROR message and wondered how best to achieve this?
Via a template and Regex or some other way?

Nirvana would be to have a dashboard widget with errors and warnings counter from x time period.

image
image885×102 8.33 KB

image

2

Hello. @Si-Richards,
I’m not sure how to do this with the TICK stack, but if you’re open to using 2.0, then I can recommend these blogs:

Basically you could create a task that counts the number of WARNING or ERROR messages.

Thanks!

3

Hi Anais,

I’ve used your suggestion and its working well.
So much so that i am now using the same setup to ingest Fail2ban logs so that IPs can be centrally checked as the Telegraf input doesnt list them (unless i missed something obvious).

So everything is good !!

image
image1840×450 36.9 KB

4

This topic was automatically closed 60 minutes after the last reply. New replies are no longer allowed.