elastic-recheck/queries/1240256.yaml
Joe Gordon 0fcc6ccb33 Remove false positives from query 1240256
Logstash doesn't appear to do exact matching for " 503 " so expand
query.

Change-Id: I83b83020a62cc1d50eb2960c51c0c1bdc751bf57
2014-03-10 18:27:15 -07:00

5 lines
103 B
YAML

query: >
message:"HTTP/1.0 503"
AND filename:"logs/syslog.txt"
AND syslog_program:"proxy-server"