Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Compatibility with Graylog 2.0 #3

Closed
Benoss opened this issue Mar 15, 2016 · 5 comments
Closed

Compatibility with Graylog 2.0 #3

Benoss opened this issue Mar 15, 2016 · 5 comments

Comments

@Benoss
Copy link
Contributor

Benoss commented Mar 15, 2016

I don't have any _http metrics in the message
on the other hand everything else seems ok, including extracting the X-HEADERS data

Looking at the logs it looks like now you can't have nested values

2016-03-15 03:17:52,481 WARN : org.graylog2.plugin.Message - Keys must not contain a "." character! Ignoring field "http.monitor.responseTime"="207" in message [80e15510-ea5c-11e5-ad8b-62df949bdde0].
2016-03-15 03:17:52,481 WARN : org.graylog2.plugin.Message - Keys must not contain a "." character! Ignoring field "http.monitor.status"="200" in message [80e15510-ea5c-11e5-ad8b-62df949bdde0].
2016-03-15 03:17:52,482 WARN : org.graylog2.plugin.Message - Keys must not contain a "." character! Ignoring field "http.monitor.statusLine"="OK" in message [80e15510-ea5c-11e5-ad8b-62df949bdde0].
2016-03-15 03:17:52,482 WARN : org.graylog2.plugin.Message - Keys must not contain a "." character! Ignoring field "http.monitor.responseSize"="19518" in message [80e15510-ea5c-11e5-ad8b-62df949bdde0].
2016-03-15 03:17:52,483 WARN : org.graylog2.plugin.Message - Keys must not contain a "." character! Ignoring field "http.monitor.url"="https://www.google.co.nz" in message [80e15510-ea5c-11e5-ad8b-62df949bdde0].

image

@Benoss
Copy link
Contributor Author

Benoss commented Mar 15, 2016

Quick fix
#4
This is probably going to break all your dashboards

@gqs
Copy link

gqs commented May 11, 2016

Hello,

How i can update my ES 1.7 to 2.x when i have used this plugin ?

Dots in field names lead to ambiguous field resolution, in fields: message:http\.monitor\.responseSize, message:http\.monitor\.responseTime, message:http\.monitor\.status, message:http\.monitor\.statusLine, message:http\.monitor\.url.

Thanks

@sivasamyk
Copy link
Owner

@gqs
Copy link

gqs commented May 12, 2016

Thanks, but how i can update the ES 1.7 indices for replace the "dots" by "underscore" before ?

@sivasamyk
Copy link
Owner

This is breaking change in ES migration from 1.7. please see http://docs.graylog.org/en/2.0/pages/upgrade.html#dots-in-field-names for more info

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants