untergeek

for index in $(ls /data/ES/elasticsearch/nodes/0/indices/); do echo -n "$index " ; curl -s -XGET "http://localhost:9200/$index/_segments?pretty=true" | grep committed_segments | awk -F: '{print $2}' | awk -F, '{sum += $1}; END {print sum}' | tail -1; done 

untergeek

{
  "template" : "logstash-*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "analysis" : {
      "analyzer" : {
        "default" : {
          "type" : "standard",
          "stopwords" : "_none_"
        }

untergeek

{
  "template" : "logstash-*",
  "settings" : {
    "index.refresh_interval" : "5s",
    "analysis" : {
      "analyzer" : {
        "default" : {
          "type" : "standard",
          "stopwords" : "_none_"
        }

untergeek

#!/bin/bash

curl -XDELETE http://localhost:9200/_template/logstash?pretty=true

echo
echo "Deleted current logstash template..."

echo "Creating new logstash template..."
sleep 2

untergeek

{
  "@version":"1",
  "@timestamp":"2013-12-29T15:41:02.123Z",
  "host":"host.example.com",
  "collectd_type":"df_complex",
  "plugin":"df",
  "plugin_instance":"Volumes-Time Machine Backups",
  "type_instance":"used",
  "value":2604146343936.0,
  "tags":["collectd"]

untergeek

#!/bin/bash
#
#
# Usage 
# This script do nothing, it juste show files that are scanned or not by
# Logstash and plugin File. 3 outputs
#
# ./utilSinceDB.sh
# ./utilSinceDB.sh | grep "not found in sincedb"
# ./utilSinceDB.sh | grep "to delete"

untergeek

indices.memory.index_buffer_size: 15%
cluster.name: untergeek
node.name: "NotSony"
discovery.zen.minimum_master_nodes: 2
discovery.zen.ping.timeout: 10s

untergeek

I have spent quite a bit of time figuring out automounts of NFS shares in OS X...

Somewhere along the line, Apple decided allowing mounts directly into /Volumes should not be possible:

/etc/auto_master (see last line):

#
# Automounter master map
#

+auto_master # Use directory service

untergeek

input {  
  irc {
    channels => [ "#logstash" ]
    host => "irc.freenode.org"
    nick => "arbitrary_bot_name"
    port => 6667
    type => "irc"
  }
}

untergeek

# This is the simplest definition, with the addition of a type
input {
  udp {
    port => 25826         # Must be specified. 25826 is the default for collectd
    buffer_size => 1452   # Should be specified. 1452 is the default for recent versions of collectd
    codec => collectd { } # This will invoke the default options for the codec
    type => "collectd"
  }
}