From f91c90be4aa9f0684766ffa8d0294c47ac207abe Mon Sep 17 00:00:00 2001
From: Philipp Dallig <philipp.dallig@pixelpark.com>
Date: Thu, 29 Jun 2017 15:03:15 +0200
Subject: [PATCH] fbb-db - correct logstash filter

---
 customer/fbb-db/common.yaml | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/customer/fbb-db/common.yaml b/customer/fbb-db/common.yaml
index 3ede86c6..e76b69c2 100644
--- a/customer/fbb-db/common.yaml
+++ b/customer/fbb-db/common.yaml
@@ -48,19 +48,16 @@ logstash::generic_resource:
       tags:
         - "%{customer}"
         - "%{tier}"
-  mysql_filter_1:
-    condition: 'if [type] == "mysql-error"'
-    resource: multiline
-    order: 39  # Filter
-    parameters:
-      pattern: '^%%{ich-trickse}{NUMBER} *%%{ich-trickse}{NUMBER}'
-      negate: 'true'
-      what: 'previous'
-  mysql_filter_2:
+      codec:
+        type: multiline
+        what: previous
+        negate: true
+        pattern: '%%{ich-trickse}{TIMESTAMP_ISO8601:time} *%%{ich-trickse}{INT:threadid}? *\[%%{ich-trickse}{WORD:loglevel}\] *%%{ich-trickse}{GREEDYDATA:restmessage}'
+  mysql_filter:
     condition: 'if [type] == "mysql-error"'
     resource: grok
     order: 40  # Filter
     parameters:
       match:
         - message
-        - '%%{ich-trickse}{TIMESTAMP_ISO8601:time} *%%{ich-trickse}{INT:threadid}? *\[%%{ich-trickse}{WORD:loglevel}\] *%%{ich-trickse}{GREEDYDATA:message}'
\ No newline at end of file
+        - '%%{ich-trickse}{TIMESTAMP_ISO8601:time} *%%{ich-trickse}{INT:threadid}? *\[%%{ich-trickse}{WORD:loglevel}\] *%%{ich-trickse}{GREEDYDATA:restmessage}'
\ No newline at end of file
-- 
2.39.5