Fix blank microversion

It is possible that OpenStack has no microversion logged which
would fail to parse.  This fixes that.

Change-Id: Ic0d49541b5863d1bdff3138c36d9de6331a7cafa
This commit is contained in:
Mohammed Naser 2018-09-27 15:48:32 -04:00
parent 4f03c51118
commit 3b8961beca

View File

@ -205,13 +205,13 @@
if [module] == "nova.api.openstack.requestlog" {
grok {
match => { "logmessage" => "%{IPORHOST:client_ip} \"%{WORD:verb} %{NOTSPACE:request}\" status\: %{NUMBER:response} len\: %{NUMBER:bytes} microversion\: %{NUMBER:microversion} time\: %{NUMBER:duration:float}" }
match => { "logmessage" => "%{IPORHOST:client_ip} \"%{WORD:verb} %{NOTSPACE:request}\" status\: %{NUMBER:response} len\: %{NUMBER:bytes} microversion\: (%{NUMBER:microversion}|\-) time\: %{NUMBER:duration:float}" }
add_tag => ["api"]
remove_field => [ "logmessage", "message" ]
}
} else if [module] == "nova.api.openstack.placement.requestlog" {
grok {
match => { "logmessage" => "%{IPORHOST:client_ip} \"%{WORD:verb} %{NOTSPACE:request}\" status\: %{NUMBER:response} len\: %{NUMBER:bytes} microversion\: %{NUMBER:microversion}" }
match => { "logmessage" => "%{IPORHOST:client_ip} \"%{WORD:verb} %{NOTSPACE:request}\" status\: %{NUMBER:response} len\: %{NUMBER:bytes} microversion\: (%{NUMBER:microversion}|\-)" }
add_tag => ["api"]
remove_field => [ "logmessage", "message" ]
}