Fluentd: fix duplicate log level naming

Fluentd config actually used two keywords to named log level:
"log_level" and "severity_label".
This doesn't allow to search and sort ALL logs in Kibana using a unique
field (ex: log_level).
This fix standardize log level keyword naming.

Closes-Bug: #1713410
Change-Id: Ibb2eaf3b6aa21ce6f7945e768e6362c0d40f0507
This commit is contained in:
Bertrand Lallau 2017-08-28 08:44:18 +02:00
parent ebd8d765f9
commit b649ae922f
3 changed files with 3 additions and 3 deletions

View File

@ -12,7 +12,7 @@
<filter apache_access>
@type record_transformer
<record>
severity_label INFO
log_level INFO
Severity 6
</record>
</filter>

View File

@ -3,7 +3,7 @@
reserve_data true
format grok
key_name message
grok_pattern %{TIMESTAMP_ISO8601:Timestamp} %{NUMBER:Pid} %{LOGLEVEL:severity_label} %{NOTSPACE:python_module} \[(?:req-(?:%{NOTSPACE:request_id}) (?:%{NOTSPACE:user_id}) (?:%{NOTSPACE:tenant_id}) (?:%{NOTSPACE:domain_id}) (?:%{NOTSPACE:user_domain}) (?:%{NOTSPACE:project_domain})|-)\] %{GREEDYDATA:Payload}
grok_pattern %{TIMESTAMP_ISO8601:Timestamp} %{NUMBER:Pid} %{LOGLEVEL:log_level} %{NOTSPACE:python_module} \[(?:req-(?:%{NOTSPACE:request_id}) (?:%{NOTSPACE:user_id}) (?:%{NOTSPACE:tenant_id}) (?:%{NOTSPACE:domain_id}) (?:%{NOTSPACE:user_domain}) (?:%{NOTSPACE:project_domain})|-)\] %{GREEDYDATA:Payload}
time_format "%Y-%m-%d %H:%M:%S.%L"
time_key Timestamp
keep_time_key true

View File

@ -6,6 +6,6 @@
tag infra.mariadb
format multiline
format_firstline /^\d{6}/
format1 /^(?<time>\d{6} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<severity_label>\S+)\] (?<Payload>.*)/
format1 /^(?<time>\d{6} \d{1,2}:\d{1,2}:\d{1,2}) \[(?<log_level>\S+)\] (?<Payload>.*)/
time_format %y%m%d %k:%M:%S
</source>