I noticed this tonight: {:timestamp=>”2015-04-18T01:01:54.363000+0000″, :message=>”Failed parsing date from field”, :field=>”syslog_timestamp”, :value=>”Apr 18 01:01:49″, :exception=>java.lang.IllegalArgumentException: Invalid format: “Apr 18 01:01:49″ is malformed at ” 18 01:01:49″, :level=>:warn} It seems this is the cause: For the record, here are all such instances: One day, I’ll come back here and fix that.
I’m doing some work with logstash-forwarder as part of a consolidation effort to get all the logs into one place, and using logstash to put them into Elasticsearch. logstash-fowarder requires the Go programming language, and that will be our first step. Installing go, the programming language I am assuming you are installing go at /usr/local; adjust the path to suit. I am installing from source because older versions of go will not work.
Getting logstash-forwarder working Read More »