imweijh

# the following two lines give a two-line status, with the current window highlighted
hardstatus alwayslastline
hardstatus string '%{= kG}[%{G}%H%? %1`%?%{g}][%= %{= kw}%-w%{+b yk} %n*%t%?(%u)%? %{-}%+w %=%{g}][%{B}%m/%d %{W}%C%A%{g}]'

# huge scrollback buffer
defscrollback 5000

# no welcome message
startup_message off

imweijh

#!/bin/bash

# Make sure we have the dev tools
yum groupinstall "Development Tools"

# Just in case you started installing dependencies from yum
yum -y remove libnfnetlink

# lets put the source code here
mkdir -p ~/.src

imweijh

logstash needs full time love.

There are roughly 70 code contributors to the logstash project as of today. Many more exist as helpful folks on IRC and the mailling list. Others post awesome bug reports and feature requests. The community is simply awesome.

I've been working on logstash for about 2 years. All as a hobby - all part-time. About 70% of the current content (commits, 'git blame' lines, etc) are by me.

Unfortunately, I've never used logstash in production. (Embarrassing, I know!)

I'm embarrassed to answer user questions like "How do I optimize elasticsearch's storage?" with "Sorry, I've never used elasticsearch outside of my laptop."

imweijh

Long story, short: I'm totally open to supporting more rubies if possible. Details follow.

Related issue: http://code.google.com/p/logstash/issues/detail?id=37

Summary:

• core and stdlib ruby changes violently and without notice and without backwards compatibility. I want nothing of that.
• need a cross-ruby date library that isn't part of stdlib (see previous point) and is also good.
• need an easy way to use multiple cpus that is cross-ruby (threads are not it)

imweijh

#################
# Sflow Filters #
#################

filter {

    if [type] == "sflow" {

# sFlow sends two kinds of messages - CNTRs and FLOWs
# I'm not doing anything with CNTRs at this point, so

imweijh

"0": HOPOPT
"1": ICMP
"2": IGMP
"3": GGP
"4": IPv4
"5": ST
"6": TCP
"7": CBT
"8": EGP
"9": IGP

imweijh

"0x00": NULL
"0x01": FIN
"0x02": SYN
"0x03": FIN-SYN
"0x08": PSH
"0x09": FIN-PSH
"0x0A": SYN-PSH
"0x0B": FIN-SYN-PSH
"0x10": ACK
"0x11": FIN-ACK

imweijh

Curator Binary Creation (Windows Edition)

Prerequisites

Please install in this order.

Install Python

• Download 2.7.9 (64-bit)
• Install with these options:
  • Install for all users
  • Customize Python 2.7.9:
    • Select Add python.exe to Path

imweijh

package main

import (
	"log"
	"bufio"
	"time"
	"os"
	"fmt"
	"io"
	"net"

imweijh

$thres=0.02, .es(index='metricbeat*',metric='max:system.cpu.user.pct').lines(1).if(eq, 0, null).holt(0.9, 0.1, 0.9, 0.5h).color(#eee).lines(10).label('Prediction'), .es(index='metricbeat*',metric='max:system.cpu.user.pct').color(#666).lines(1).label(Actual), .es(index='metricbeat*',metric='max:system.cpu.user.pct').lines(1).if(eq, 0, null).holt(0.9, 0.1, 0.9, 0.5h).subtract(.es(index='metricbeat*',metric='max:system.cpu.user.pct')).abs().if(lt, $thres, null, .es(index='metricbeat*',metric='max:system.cpu.user.pct')).points(10,3,0).color(#c66).label('Anomaly').title('max:system.cpu.user.pct / @rmoff')