Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Journalbeat: parse entries for procs identified by PID and user #15849

Closed
bpintea opened this issue Jan 26, 2020 · 0 comments · Fixed by #16116
Closed

Journalbeat: parse entries for procs identified by PID and user #15849

bpintea opened this issue Jan 26, 2020 · 0 comments · Fixed by #16116
Assignees
Labels
bug good first issue Indicates a good issue for first-time contributors Journalbeat Team:Integrations Label for the Integrations team

Comments

@bpintea
Copy link

bpintea commented Jan 26, 2020

Describe the enhancement:
For some processes, the journal will identify the instance by process and user. Parsing these lines fails currently. The enhancement would be about handling the user part; for instance ignoring it.

Tried on master (33f7112).

Describe a specific use case for the enhancement or feature:
Example of such a line:
Jan 26 22:11:06 muppet vncserver-x11[573,root]: AgentInitCheck: agent comms failure

Logged failure:
{"type":"mapper_parsing_exception","reason":"failed to parse field [syslog.pid] of type [long] in document with id 'nlqj428BvnVtNfGL9fwO'. Preview of field' s value: '573,root'","caused_by":{"type":"illegal_argument_exception","reason":"For input string: \"573,root\""}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug good first issue Indicates a good issue for first-time contributors Journalbeat Team:Integrations Label for the Integrations team
Projects
None yet
5 participants