Mailing-List: contact dev-help@brooklyn.incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@brooklyn.incubator.apache.org
Message-ID: <55DC87F3.2040701@gmail.com>
Date: Tue, 25 Aug 2015 11:21:23 -0400
From: Hadrian Zbarcea <hzbarcea@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.8.0
MIME-Version: 1.0
To: dev@brooklyn.incubator.apache.org
Subject: Re: Brooklyn logstash enricher
References: 
 <CADBrumZSTvrwM2st2BkyGHaozUXbZdbiEcHYWpAazm98C0XXdw@mail.gmail.com>
In-Reply-To: 
 <CADBrumZSTvrwM2st2BkyGHaozUXbZdbiEcHYWpAazm98C0XXdw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Shouldn't this be a policy?
Hadrian

On 08/25/2015 10:45 AM, Duncan Grant wrote:
> I'm considering adding logstash functionality so that a blueprint can be
> extended so that logstash is installed on each vm and collect logs and
> forward them to something like elastic search.
>
> My initial plan is to create a logstash enricher that can be attached to an
> entity.  It would install logstash and configure it to look at the parent
> entity's log location.  The filter and output config would be configurable
> on the enricher making it fairly straightforward to configure where the
> logs are sent e.g. elastic search.
>
> So yaml might look something like
>
> services:
> -type: BasicEntity
>    brooklyn.enrichers:
>    - type: Logstash
>      brooklyn.config:
>        input:
>          file
>            path: "/path/to/file"
>        filter:
>          grok:
>            match:
>              message: "%{COMBINEDAPACHELOG}"
>        output:
>          elasticsearch
>            protocol: "http"
>
> With default behaviour for each of input, filter, output if they are not in
> the yaml.
>
> Does this make sense?
>
> Regards
>
> Duncan
>