From 5c8ba12171f96ee8f9a2f203e51b1bb07e619191 Mon Sep 17 00:00:00 2001 From: Philipp Dallig Date: Fri, 18 Mar 2016 11:50:24 +0100 Subject: [PATCH] DATA is more generic then WORD, because some pools has names like www.pfizer.de --- classes/site::profile::logstash::php_fpm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/classes/site::profile::logstash::php_fpm.yaml b/classes/site::profile::logstash::php_fpm.yaml index fcf9f648..01b034d7 100644 --- a/classes/site::profile::logstash::php_fpm.yaml +++ b/classes/site::profile::logstash::php_fpm.yaml @@ -22,7 +22,7 @@ site::profile::logstash::php_fpm::resources: type: multiline what: previous negate: true - pattern: '\[%%{ich-trickse}{MONTHDAY}-%%{ich-trickse}{MONTH}-%%{ich-trickse}{YEAR} %%{ich-trickse}{TIME}\]%%{ich-trickse}{SPACE}\[pool %%{ich-trickse}{WORD:pool}] %%{ich-trickse}{GREEDYDATA:restmessage}' + pattern: '\[%%{ich-trickse}{MONTHDAY}-%%{ich-trickse}{MONTH}-%%{ich-trickse}{YEAR} %%{ich-trickse}{TIME}\]%%{ich-trickse}{SPACE}\[pool %%{ich-trickse}{DATA:pool}] %%{ich-trickse}{GREEDYDATA:restmessage}' php_fpm_error_filter: condition: 'if [type] == "php-fpm-error"' resource: grok -- 2.39.5