From: Mateusz Matuszkowiak <mmatuszkowiak@mirantis.com>
Date: Mon, 13 Aug 2018 08:22:35 +0000 (+0200)
Subject: Fixed the regex for ES logs
X-Git-Url: https://gerrit.mcp.mirantis.com/gitweb?p=salt-formulas%2Felasticsearch.git;a=commitdiff_plain;h=refs%2Fchanges%2F80%2F24280%2F5;hp=4422a30bd640aa826e7f0be9ffede204ce19d9ba

Fixed the regex for ES logs

Catch both time formats regarding ES logs.

Change-Id: Id088cc0af107a75eb810fe652f788a2c9c3144d7
Closes-Bug: PROD-21812
---

diff --git a/elasticsearch/meta/fluentd.yml b/elasticsearch/meta/fluentd.yml
index 17848d0..b083372 100644
--- a/elasticsearch/meta/fluentd.yml
+++ b/elasticsearch/meta/fluentd.yml
@@ -9,25 +9,25 @@ agent:
             tag: elasticsearch.general
             path: /var/log/elasticsearch/elasticsearch.log
             pos_file: {{ pillar.fluentd.agent.dir.positiondb }}/elasticsearch.general.pos
-            format: '/^\[(?<time>[^ ]* [^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] \[([^\]]*) *\] (?<Payload>.+)/'
+            format: '/^\[(?<time>[^ ]* ?[^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] \[([^\]]*) *\] (?<Payload>.+)/'
           tail_elasticsearch_deprecation:
             type: tail
             tag: elasticsearch.deprecation
             path: /var/log/elasticsearch/elasticsearch_deprecation.log
             pos_file: {{ pillar.fluentd.agent.dir.positiondb }}/elasticsearch.deprecation.pos
-            format: '/^\[(?<time>[^ ]* [^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] (?<Payload>.+)/'
+            format: '/^\[(?<time>[^ ]* ?[^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] (?<Payload>.+)/'
           tail_elasticsearch_index_indexing_slowlog:
             type: tail
             tag: elasticsearch.slowlog.indexing
             path: /var/log/elasticsearch/elasticsearch_index_indexing_slowlog.log
             pos_file: {{ pillar.fluentd.agent.dir.positiondb }}/elasticsearch.slowlog.indexing.pos
-            format: '/^\[(?<time>[^ ]* [^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] (?<Payload>.+)/'
+            format: '/^\[(?<time>[^ ]* ?[^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] (?<Payload>.+)/'
           tail_elasticsearch_index_search_slowlog:
             type: tail
             tag: elasticsearch.slowlog.search
             path: /var/log/elasticsearch/elasticsearch_index_search_slowlog.log
             pos_file: {{ pillar.fluentd.agent.dir.positiondb }}/elasticsearch.slowlog.search.pos
-            format: '/^\[(?<time>[^ ]* [^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] (?<Payload>.+)/'
+            format: '/^\[(?<time>[^ ]* ?[^ ]*)\]\[(?<severity_label>[^ ]*) *?\]\[([^ ]*) *\] (?<Payload>.+)/'
         filter:
           match_severity:
             type: record_transformer