Journalbeat: parse entries for procs identified by PID and user #15849
Labels
bug
good first issue
Indicates a good issue for first-time contributors
Journalbeat
Team:Integrations
Label for the Integrations team
Describe the enhancement:
For some processes, the journal will identify the instance by process and user. Parsing these lines fails currently. The enhancement would be about handling the user part; for instance ignoring it.
Tried on master (33f7112).
Describe a specific use case for the enhancement or feature:
Example of such a line:
Jan 26 22:11:06 muppet vncserver-x11[573,root]: AgentInitCheck: agent comms failure
Logged failure:
{"type":"mapper_parsing_exception","reason":"failed to parse field [syslog.pid] of type [long] in document with id 'nlqj428BvnVtNfGL9fwO'. Preview of field' s value: '573,root'","caused_by":{"type":"illegal_argument_exception","reason":"For input string: \"573,root\""}
The text was updated successfully, but these errors were encountered: