greem

GNU gdb (GDB) Red Hat Enterprise Linux (7.2-92.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/rspamadm...Reading symbols from /usr/lib/debug/usr/bin/rspamadm.debug...done.

greem

This refers to the thread on the LS mailing list:

https://groups.google.com/forum/#!msg/logstash-users/6EiyGnQQnNM/41fcJr-eet4J

where a user was having problems getting LS to start as they would have expected. Long story short, the "file" input will wait forever for a file if it doesn't exist.


[root@lumberjack ~]# /opt/logstash/bin/logstash --debug -e 'input { file { path => "/tmp/thingy-for-logstash" start_position => "beginning" sincedb_path => "/dev/null" } } output { stdout {} }'
Compiled pipeline code:
@inputs = []

greem

{
  "title": "MX & MTA Statistics (by no. recipients)",
  "services": {
    "query": {
      "list": {
        "0": {
          "id": 0,
          "color": "#508642",
          "alias": "Received",
          "pin": false,

greem

#!/bin/bash

curl -XPUT 'http://localhost:9200/_template/exim' -d '{
  "order" : 0,
  "template" : "exim*",
  "settings" : {
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "deferred" : {

greem

input {
  file {
    path => "/path/to/exim/mainlog"
    start_position => 'beginning'
    sincedb_path => "/dev/null"
  }
}

filter {

greem

EXIM_MSGID [0-9A-Za-z]{6}-[0-9A-Za-z]{6}-[0-9A-Za-z]{2}
EXIM_FLAGS (<=|[-=>*]>|[*]{2}|==)
EXIM_DATE %{YEAR:exim_year}-%{MONTHNUM:exim_month}-%{MONTHDAY:exim_day} %{TIME:exim_time}
EXIM_PID \[%{POSINT}\]
EXIM_QT ((\d+y)?(\d+w)?(\d+d)?(\d+h)?(\d+m)?(\d+s)?)
EXIM_EXCLUDE_TERMS (Message is frozen|(Start|End) queue run| Warning: | retry time not reached | no (IP address|host name) found for (IP address|host) | unexpected disconnection while reading SMTP command | no immediate delivery: |another process is handling this message)
EXIM_REMOTE_HOST (H=(%{NOTSPACE:remote_hostname} )?(\(%{NOTSPACE:remote_heloname}\) )?\[%{IP:remote_host}\])
EXIM_INTERFACE (I=\[%{IP:exim_interface}\](:%{NUMBER:exim_interface_port}))
EXIM_PROTOCOL (P=%{NOTSPACE:protocol})
EXIM_MSG_SIZE (S=%{NUMBER:exim_msg_size})