Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2008 (ugh) system that I'm pulling messages from with Logstash and nxlog. With nxlog as the log shipper, messages as they appear in the log file are sent to the parser:

2013-12-28T05:30:10.575-08:00 [06284 error 'commonvpxVmomi' opID=df11e5ea] [VpxVmomi] Exception while sending result: An established connection was aborted by the software in your host machine. \r

But I also setup Logstash to run as a service on the same 2k8 box and it's apparently altering the message structure:

{"message":"2013-12-28T05:30:10.575-08:00 [06284 error 'commonvpxVmomi' opID=df11e5ea] [VpxVmomi] Exception while sending result: An established connection was aborted by the software in your host machine. \r","@timestamp":"2013-12-30T22:33:20.019Z","@version":"1","host":"hostname","path":"C:/vmware_logs/vpxd-48.log"}

I followed this simple guide to setup Logstash running as a Windows service. There's no problem parsing the messages that get shipped with nxlog but the extra fields that I'm getting with the Logstash shipper are obviously causing issues. Also, I have another Logstash forwarding instance between the 2k8 box and the main Logstash parser that doesn't cause this to happen. The messages could be mutated to remove the extra fields and whatnot but I'm just curious as to why Logstash is doing this. The Logstash config on the 2k8 box is very basic so I can't imagine how it would be doing this:

input {
  file {
    path => [ "C:/vmware_logs/vpxd-[0-5][0-9].log", "C:/vmware_logs/vpxd-alert-[0-5][0-9].log" ]
    exclude => "*.gz"
  }
}

output {
  udp {
    host => "172.24.69.125"
    port => "514"
  }
}

Has anyone else seen this or does anybody know why this is happening with the messages?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.