Issues with cf_app_id for some events.

[simonjohansson]

{"cf_app_id":{"low":307803602406404138,"high":12626693043313324730},"content_length":17,"event_type":4,"instance_id":"e5ca5558240d4b22b96be814e85732def449a6afc3374cf89876f32f95e576f5","instance_index":0,"level":"info","method":1,"msg":"","origin":"router__0","parent_request_id":{"low":3623130128173741517,"high":13739927289683842897},"peer_type":1,"remote_addr":"10.230.16.4:46853","request_id":{"low":17960694338432120122,"high":5986596037565401678},"start_timestamp":1427878953848040371,"status_code":200,"stop_timestamp":1427878953855930658,"time":"2015-04-01T11:02:33+02:00","uri":"super-secret.com","user_agent":"NING/1.0"}

Im pretty sure "{"low":307803602406404138,"high":12626693043313324730}" is not a cf_app_id. :)

[shinji62]

Not sure this still happen.

[mrdavidlaing]

I'm seeing similar log entries:

{"cf_app_id":null,"cf_app_name":"","cf_org_id":"","cf_org_name":"","cf_space_id":"","cf_space_name":"","content_length":109,"event_type":"HttpStartStop","instance_id":"10.10.3.7:9022","instance_index":0,"level":"info","method":1,"msg":"","origin":"router__0","parent_request_id":{"low":3911635444434851561,"high":2736400713923459192},"peer_type":1,"remote_addr":"10.10.2.6:50851","request_id":{"low":6362214824335119455,"high":8235263211746456914},"start_timestamp":1429593653310241917,"status_code":404,"stop_timestamp":1429593653315400686,"time":"2015-04-21T05:20:53Z","uri":"api.run.54.183.203.97.xip.io/v2/apps/\u003cnil\u003e","user_agent":"Go 1.1 package http"}

Note how "cf_app_id":null, so I think this issue is at least partially fixed already.

That said, it would be even better if

"cf_app_id":null,"cf_app_name":"","cf_org_id":"","cf_org_name":"","cf_space_id":"","cf_space_name":""

were omitted from the message entirely.

Is that feasible?

[shinji62]

"cf_app_id":null Ok will be difficult to track down this one.

[shinji62]

@mrdavidlaing If you have any ELK dashboard with the last version of firehose-to-syslog, I really to see it.

[simonjohansson]

| That said, it would be even better if
|"cf_app_id":null,"cf_app_name":"","cf_org_id":"","cf_org_name":"","cf_space_id":"","cf_space_name":""
|were omitted from the message entirely.

|Is that feasible?

That would be feasible, and Ill agree with that approach.

[shinji62]

Should be ok.