Change parser regexp for /var/log/apache2/keystone.access.log in td-agent config file.
In case of two IP's in http_x_forwarded_for_address field in /var/log/apache2/keystone.access.log
td-agent can't parse logs from keystone-wsgi and can't send it to Elastic.
Fixes-bug: PROD-36420
Change-Id: I8c49fe42399d42f226206c9c807d9ab115b69bef
diff --git a/keystone/meta/fluentd.yml b/keystone/meta/fluentd.yml
index 6bc613a..cb9f561 100644
--- a/keystone/meta/fluentd.yml
+++ b/keystone/meta/fluentd.yml
@@ -71,8 +71,8 @@
time_key: Timestamp
time_format: '%d/%b/%Y:%H:%M:%S %z'
keep_time_key: false
- # Apache keystone format: https://regex101.com/r/KkL3my/1/
- format: '/(?<hostname>[\w\.\-]+)\:(?<port>\d+)\s(?<http_x_forwarded_for_address>[\d\.]+|-)\s(?<http_client_ip_address>[\d\.]+)\s\-\s\-\s\[(?<Timestamp>.*)\]\s(?<Payload>\"(?<http_method>[A-Z]+)\s(?<http_url>\S+)\s(?<http_version>[.\/\dHTFSP]+)\"\s(?<http_status>\d{3})\s(?<http_response_time>\d+)\s(?<http_response_size>\d+)\s\"(?<http_referer>.*)\"\s\"(?<user_agent>.*)\")/'
+ # Apache keystone format: https://regex101.com/r/KkL3my/3/
+ format: '/(?<hostname>[\w\.\-]+)\:(?<port>\d+)\s(?<http_x_forwarded_for_address>(?:[\d\.]+(?:, )*)*|(?:[\d\.]*)|-)\s(?<http_client_ip_address>[\d\.]+)\s\-\s\-\s\[(?<Timestamp>.*)\]\s(?<Payload>\"(?<http_method>[A-Z]+)\s(?<http_url>\S+)\s(?<http_version>[.\/\dHTFSP]+)\"\s(?<http_status>\d{3})\s(?<http_response_time>\d+)\s(?<http_response_size>\d+)\s\"(?<http_referer>.*)\"\s\"(?<user_agent>.*)\")/'
filter:
add_keystone_wsgi_record_fields:
tag: openstack.keystone
diff --git a/tests/integration/queens/single/config_spec.rb b/tests/integration/queens/single/config_spec.rb
index f82b08e..da9a00d 100644
--- a/tests/integration/queens/single/config_spec.rb
+++ b/tests/integration/queens/single/config_spec.rb
@@ -145,7 +145,7 @@
'max_overflow' => '30',
'max_pool_size' => '10',
'max_retries' => '-1',
- 'connection_recycle_time' => '280',
+ 'connection_recycle_time' => '3600',
}
keystone_oslo_middleware = {