Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to push logs to Log Analytics #3

Closed
koksan83 opened this issue Aug 28, 2017 · 2 comments
Closed

Unable to push logs to Log Analytics #3

koksan83 opened this issue Aug 28, 2017 · 2 comments
Assignees

Comments

@koksan83
Copy link

Issue description:
Unable to push logs to Log Analytics using the provided sample config and log line. Not sure how to gather more info to troubleshoot further.

Config used:

<source>
    @type tail                         # input plugin
    path /tmp/access.log   # monitoring file
    pos_file /tmp/fluentd_pos_file     # position file
    format apache                      # format
    tag azure-loganalytics.access      # tag
</source>

<match azure-loganalytics.**>
    @type azure-loganalytics
    customer_id foobar   # Customer ID aka WorkspaceID String
    shared_key foobar     # The primary or the secondary Connected Sources client authentication key
    log_type access_FL  # The name of the event type. ex) ApacheAccessLog
    add_tag_field true
    tag_field_name access_FL_tag
</match>

Steps to reproduce the issue:

  • Start docker container with ruby:2.4.1-jessie image
  • Install td-agent
  • Install fluent-plugin-azure-loganalytics via td-agent
  • Apply above config and restart td-agent
  • Append the log line from README to tailed file:
124.211.152.156 - - [10/Dec/2016:05:28:52 +0000] "GET /test/foo.html HTTP/1.1" 200 323 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36"

What's the expected result?
Log gets sent to Azure Log Analytics

What's the actual result?
Output from /var/log/td-agent/td-agent.log:

2017-08-28 07:02:11 +0000 [fatal]: #0 Exception occured in posting to DataCollector API:
2017-08-28 07:02:11 +0000 [warn]: #0 failed to flush the buffer. retry_time=8 next_retry_seconds=2017-08-28 07:02:11 +0000 chunk="557cacc5a24ffe7d37bd7548ca8352bb" error_class=NoMethodError error="undefined method `+@' for #<String:0x007f24e4c48028>"
2017-08-28 07:02:11 +0000 [warn]: #0 suppressed same stacktrace
@yokawasa yokawasa self-assigned this Aug 31, 2017
@yokawasa
Copy link
Owner

yokawasa commented Sep 5, 2017

@koksan83
log_type value in the plugin configuration must be only 'alpha characters'.
Can you change log_type value to 'accessFL' (only alpha) instead of 'access_FL' and try again?

<match azure-loganalytics.**>
    @type azure-loganalytics
    customer_id foobar   # Customer ID aka WorkspaceID String
    shared_key foobar     # The primary or the secondary Connected Sources client authentication key
    log_type accessFL  # The name of the event type. ex) ApacheAccessLog
    add_tag_field true
    tag_field_name access_FL_tag
</match>

On my side, I'll add explanation on restriction of log_type field, also I add some code to prevent users to give non-alpha characters to log_type field.

@yokawasa
Copy link
Owner

yokawasa commented Sep 6, 2017

I've release fluent-plugin-azure-loganalytics 0.3.1

@yokawasa yokawasa closed this as completed Sep 6, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants