Skip to content

Instantly share code, notes, and snippets.

@jbraeuer

jbraeuer/Wireshark Trace

Created March 13, 2013 13:22
Show Gist options
  • Save jbraeuer/5151981 to your computer and use it in GitHub Desktop.
Save jbraeuer/5151981 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
elasticsearch.log
[2013-03-13 13:01:07,531][DEBUG][action.index ] [precise-amd64.ber.commercetools.de] [logstash-2013.03.13][0], node[gpuHPWbxR6KwgrgnYE73ng], [P], s[STARTED]: Failed to execute [index {[logstash-2013.03.13][syslog][GxdEk4hcTPaHRCAvLCnewA], source[{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaakspöldöls","@type":"syslog]}]
org.elasticsearch.index.mapper.MapperParsingException: Failed to parse [@type]
at org.elasticsearch.index.mapper.core.AbstractFieldMapper.parse(AbstractFieldMapper.java:320)
at org.elasticsearch.index.mapper.object.ObjectMapper.serializeValue(ObjectMapper.java:587)
at org.elasticsearch.index.mapper.object.ObjectMapper.parse(ObjectMapper.java:459)
at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:486)
at org.elasticsearch.index.mapper.DocumentMapper.parse(DocumentMapper.java:430)
at org.elasticsearch.index.shard.service.InternalIndexShard.prepareCreate(InternalIndexShard.java:297)
at org.elasticsearch.action.index.TransportIndexAction.shardOperationOnPrimary(TransportIndexAction.java:211)
at org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction.performOnPrimary(TransportShardReplicationOperationAction.java:531)
at org.elasticsearch.action.support.replication.TransportShardReplicationOperationAction$AsyncShardOperationAction$1.run(TransportShardReplicationOperationAction.java:429)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:722)
Caused by: org.elasticsearch.common.jackson.core.JsonParseException: Unexpected end-of-input in VALUE_STRING
at [Source: [B@c859b59; line: 1, column: 807]
at org.elasticsearch.common.jackson.core.JsonParser._constructError(JsonParser.java:1378)
at org.elasticsearch.common.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:599)
at org.elasticsearch.common.jackson.core.base.ParserMinimalBase._reportInvalidEOF(ParserMinimalBase.java:532)
at org.elasticsearch.common.jackson.core.base.ParserMinimalBase._reportInvalidEOF(ParserMinimalBase.java:526)
at org.elasticsearch.common.jackson.core.base.ParserBase.loadMoreGuaranteed(ParserBase.java:432)
at org.elasticsearch.common.jackson.core.json.UTF8StreamJsonParser._finishString2(UTF8StreamJsonParser.java:2111)
at org.elasticsearch.common.jackson.core.json.UTF8StreamJsonParser._finishString(UTF8StreamJsonParser.java:2092)
at org.elasticsearch.common.jackson.core.json.UTF8StreamJsonParser.getText(UTF8StreamJsonParser.java:275)
at org.elasticsearch.common.xcontent.json.JsonXContentParser.text(JsonXContentParser.java:83)
at org.elasticsearch.common.xcontent.support.AbstractXContentParser.textOrNull(AbstractXContentParser.java:106)
at org.elasticsearch.index.mapper.core.StringFieldMapper.parseCreateField(StringFieldMapper.java:281)
at org.elasticsearch.index.mapper.core.StringFieldMapper.parseCreateField(StringFieldMapper.java:46)
at org.elasticsearch.index.mapper.core.AbstractFieldMapper.parse(AbstractFieldMapper.java:307)
... 11 more
Raw
logstash.conf
input {
lumberjack {
port => 55556
ssl_certificate => "/etc/logstash-indexer/logstash_server.crt"
ssl_key => "/etc/logstash-indexer/logstash_server.key"
type => "syslog"
}
}
filter {
# --------------------------------------------------------------------------------
# SYSLOG
# --------------------------------------------------------------------------------
grok {
type => "syslog"
pattern => [ "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" ]
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{@source_host}" ]
}
syslog_pri {
type => "syslog"
}
# date {
# type => "syslog"
# match => [ "syslog_timestamp" ]
# }
# mutate {
# type => "syslog"
# exclude_tags => "_grokparsefailure"
# replace => [ "@source_host", "%{syslog_hostname}" ]
# replace => [ "@message", "%{syslog_message}" ]
# }
# mutate {
# type => "syslog"
# remove => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
# }
# --------------------------------------------------------------------------------
}
output {
stdout {
debug => true
}
file {
path => "/var/log/logstash/indexer.event.log"
}
elasticsearch_http {
host => "localhost"
port => 9200
flush_size => 1
}
}
Raw
logstash.log
{:message=>"Read config", :level=>:info}
{:message=>"Start thread", :level=>:info}
{:message=>"Using experimental plugin 'lumberjack'. This plugin is untested and may change in the future. For more information about plugin statuses, see http://logstash.net/docs/1.1.9/plugin-status ", :level=>:warn}
{:message=>"Using experimental plugin 'syslog_pri'. This plugin is untested and may change in the future. For more information about plugin statuses, see http://logstash.net/docs/1.1.9/plugin-status ", :level=>:warn}
{:message=>"Grok patterns path", :patterns_dir=>["file:/usr/share/logstash/logstash.jar!/logstash/filters/../../patterns/*"], :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/firewalls", :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/haproxy", :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/java", :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/linux-syslog", :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/nagios", :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/ruby", :level=>:info}
{:message=>"Grok loading patterns from file", :path=>"file:/usr/share/logstash/logstash.jar!/patterns/grok-patterns", :level=>:info}
{:message=>"Match data", :match=>{"@message"=>["<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}"]}, :level=>:info}
{:message=>"Grok compile", :field=>"@message", :patterns=>["<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}"], :level=>:info}
{:message=>"Starting lumberjack input listener", :address=>"0.0.0.0:55556", :level=>:info}
{:message=>"Input registered", :plugin=>#<LogStash::Inputs::Lumberjack:0x293bc1ec @type="syslog", @threadable=false, @tags=[], @host="0.0.0.0", @params={"port"=>55556, "ssl_certificate"=>"/etc/logstash-indexer/logstash_server.crt", "ssl_key"=>"/etc/logstash-indexer/logstash_server.key", "type"=>"syslog", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}, "host"=>"0.0.0.0"}, @logger=#<LogStash::Logger:0x3be5824e @target=#<IO:/var/log/logstash/indexer.log>, @subscriber_lock=#<Mutex:0x58cded9a>, @metrics=#<Cabin::Metrics:0x37aa4702 @channel=#<Cabin::Channel:0xc1bf0db @subscriber_lock=#<Mutex:0x7e61c012>, @data={}, @metrics=#<Cabin::Metrics:0x43891e90 @channel=#<Cabin::Channel:0xc1bf0db ...>, @metrics={}, @metrics_lock=#<Mutex:0x5f35a293>>, @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x3a4491ba>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0xd501d0c @lock=#<Mutex:0x6a305a8>, @io=#<IO:/var/log/logstash/indexer.log>>}, @level=:info>, @debug=false, @port=55556, @lumberjack=#<Lumberjack::Server:0x38c85bff @options={:port=>55556, :address=>"0.0.0.0", :ssl_certificate=>"/etc/logstash-indexer/logstash_server.crt", :ssl_key=>"/etc/logstash-indexer/logstash_server.key", :ssl_key_passphrase=>nil}, @ssl=#<OpenSSL::SSL::SSLContext:0x381875ae @session_id_context="0e3f8216f1ffc205103aac29ca4277a0", @key=-----BEGIN RSA PRIVATE KEY-----
MIICXwIBAAKBgQDO4OrcLKgUDYCkrsmqTdnQPLMDtq+o7IJUz7I6hOVp9oR14WeU
0Ovsu+WOYfm23mOU6H6Sdbw6P3Wih+N5NsS/Se9sK66BB5JbHbVEhlntNEtZ50YQ
LZLtGCk2IKOO7xwEOBikhMxGMLot8duC1UUAn+1qDGTuot+U9fFuvrLt7QIDAQAB
AoGBAKF9JRhVq6Zrm93xqu5L8xkAKOVfN+PvKxW1Q3U2xDZg/qleGJMsOt4DFoB8
roc3NhjJG/SL/zCg1NzYopK+U/luJ4kpNtEgm3+otOgoteaBx667fofBq6Egq8+n
zpSezrNj9HxjQX/8MqrgkFAQC48OrFkPLD2YKiSGfg6Jvx3BAkEA95v1veTlg/LL
O4MMMrNfhgCMKigDg0wdLY8KHHyqGrgaEQu7mod1LqM1t2ADTRIn/P31C3Rzpgm6
Cxd+O1nG5QJBANXjnUHIExM6W5HT0Xlr2WUASjwnwE0u7bgn+gRhhRL8KycPoV4i
aXmI0VIECXvAE5qKnZwABPLjdn3ot2rPUmkCQQCsyGP/Es8l+DLhYF0OtCSgOZmV
gT6STHa/5+TCZCu/YWCvLGTJPGUFGlbNk246RcUpwX1RdP2Oi5MLUmV/vPIRAkEA
sxRCuyvfxK6MsnjtnsLMnoLypJEHsdfD0vctnnNj7rRREQBGNEGNm+MQlqGoqwLz
puW99joR6qbFs7+fqf7xWQJBAIFmg6TtxtGjDRaZwJeQsT2Csadpb2WBLiK9r4Th
T31ZEgJVC/y5VlsuWMT7djXUzyT0Ts6gPtF3Fwu3Kkp5M88=
-----END RSA PRIVATE KEY-----
, @cert=>, @ssl_server=#<OpenSSL::SSL::SSLServer:0x1bd91db8 @svr=#<TCPServer:fd 106>, @start_immediately=true, @ctx=#<OpenSSL::SSL::SSLContext:0x381875ae @session_id_context="0e3f8216f1ffc205103aac29ca4277a0", @key=-----BEGIN RSA PRIVATE KEY-----
MIICXwIBAAKBgQDO4OrcLKgUDYCkrsmqTdnQPLMDtq+o7IJUz7I6hOVp9oR14WeU
0Ovsu+WOYfm23mOU6H6Sdbw6P3Wih+N5NsS/Se9sK66BB5JbHbVEhlntNEtZ50YQ
LZLtGCk2IKOO7xwEOBikhMxGMLot8duC1UUAn+1qDGTuot+U9fFuvrLt7QIDAQAB
AoGBAKF9JRhVq6Zrm93xqu5L8xkAKOVfN+PvKxW1Q3U2xDZg/qleGJMsOt4DFoB8
roc3NhjJG/SL/zCg1NzYopK+U/luJ4kpNtEgm3+otOgoteaBx667fofBq6Egq8+n
zpSezrNj9HxjQX/8MqrgkFAQC48OrFkPLD2YKiSGfg6Jvx3BAkEA95v1veTlg/LL
O4MMMrNfhgCMKigDg0wdLY8KHHyqGrgaEQu7mod1LqM1t2ADTRIn/P31C3Rzpgm6
Cxd+O1nG5QJBANXjnUHIExM6W5HT0Xlr2WUASjwnwE0u7bgn+gRhhRL8KycPoV4i
aXmI0VIECXvAE5qKnZwABPLjdn3ot2rPUmkCQQCsyGP/Es8l+DLhYF0OtCSgOZmV
gT6STHa/5+TCZCu/YWCvLGTJPGUFGlbNk246RcUpwX1RdP2Oi5MLUmV/vPIRAkEA
sxRCuyvfxK6MsnjtnsLMnoLypJEHsdfD0vctnnNj7rRREQBGNEGNm+MQlqGoqwLz
puW99joR6qbFs7+fqf7xWQJBAIFmg6TtxtGjDRaZwJeQsT2Csadpb2WBLiK9r4Th
T31ZEgJVC/y5VlsuWMT7djXUzyT0Ts6gPtF3Fwu3Kkp5M88=
-----END RSA PRIVATE KEY-----
, @cert=>>, @tcp_server=#<TCPServer:fd 106>, @port=55556>, @ssl_certificate="/etc/logstash-indexer/logstash_server.crt", @add_field={}, @charset="UTF-8", @config={"port"=>55556, "ssl_certificate"=>"/etc/logstash-indexer/logstash_server.crt", "ssl_key"=>"/etc/logstash-indexer/logstash_server.key", "type"=>"syslog", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}, "host"=>"0.0.0.0"}, @ssl_key="/etc/logstash-indexer/logstash_server.key">, :level=>:info}
{:message=>"Output registered", :plugin=>#<LogStash::Outputs::Stdout:0x4e949d45 @fields=[], @message="%{@timestamp} %{@source}: %{@message}", @tags=[], @type="", @config={"debug"=>true, "type"=>"", "tags"=>[], "exclude_tags"=>[], "fields"=>[], "debug_format"=>"ruby", "message"=>"%{@timestamp} %{@source}: %{@message}"}, @debug_format="ruby", @params={"debug"=>true, "type"=>"", "tags"=>[], "exclude_tags"=>[], "fields"=>[], "debug_format"=>"ruby", "message"=>"%{@timestamp} %{@source}: %{@message}"}, @print_method=#<Method: LogStash::Outputs::Stdout(Kernel)#p>, @debug=true, @logger=#<LogStash::Logger:0x3be5824e @target=#<IO:/var/log/logstash/indexer.log>, @subscriber_lock=#<Mutex:0x58cded9a>, @metrics=#<Cabin::Metrics:0x37aa4702 @channel=#<Cabin::Channel:0xc1bf0db @subscriber_lock=#<Mutex:0x7e61c012>, @data={}, @metrics=#<Cabin::Metrics:0x43891e90 @channel=#<Cabin::Channel:0xc1bf0db ...>, @metrics={}, @metrics_lock=#<Mutex:0x5f35a293>>, @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x3a4491ba>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0xd501d0c @lock=#<Mutex:0x6a305a8>, @io=#<IO:/var/log/logstash/indexer.log>>}, @level=:info>, @exclude_tags=[]>, :level=>:info}
{"@source"=>"lumberjack://precise-amd64//var/log/mail.log", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.747Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/mail.log", "@message"=>"2013-03-13T10:45:02+00:00 localhost postfix/smtpd[17989]: connect from localhost[127.0.0.1]", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.751Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:02+00:00 localhost sshd[17985]: Connection closed by 127.0.0.1 [preauth]", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/mail.log", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.758Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/mail.log", "@message"=>"2013-03-13T10:45:02+00:00 localhost postfix/smtpd[17989]: disconnect from localhost[127.0.0.1]", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.760Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:02+00:00 localhost monit[15084]: 'rootfs' filesystem doesn't exist", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/mail.log", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.762Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/mail.log", "@message"=>"2013-03-13T10:45:02+00:00 localhost postfix/smtpd[17989]: connect from localhost[127.0.0.1]", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.764Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:02+00:00 localhost monit[15084]: 'rootfs' trying to restart", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/mail.log", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.766Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/mail.log", "@message"=>"2013-03-13T10:45:02+00:00 localhost postfix/smtpd[17989]: disconnect from localhost[127.0.0.1]", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.767Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:02+00:00 localhost sshd[17987]: Connection closed by 127.0.0.1 [preauth]", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.769Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:05+00:00 localhost sudo: vagrant : TTY=pts/4 ; PWD=/home/vagrant ; USER=root ; COMMAND=/usr/bin/tail -f /var/log/lumberjack/syslog.log", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.772Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:05+00:00 localhost sudo: pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.773Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:12+00:00 localhost sudo: pam_unix(sudo:session): session closed for user root", "@type"=>"syslog"}
{:message=>"Output registered", :plugin=>#<LogStash::Outputs::File:0x2a182d8e @fields=[], @gzip=false, @last_stale_cleanup_cycle=2013-03-13 13:19:40 +0000, @type="", @tags=[], @params={"path"=>"/var/log/logstash/indexer.event.log", "type"=>"", "tags"=>[], "exclude_tags"=>[], "fields"=>[], "flush_interval"=>2, "gzip"=>false}, @logger=#<LogStash::Logger:0x3be5824e @target=#<IO:/var/log/logstash/indexer.log>, @subscriber_lock=#<Mutex:0x58cded9a>, @metrics=#<Cabin::Metrics:0x37aa4702 @channel=#<Cabin::Channel:0xc1bf0db @subscriber_lock=#<Mutex:0x7e61c012>, @data={}, @metrics=#<Cabin::Metrics:0x43891e90 @channel=#<Cabin::Channel:0xc1bf0db ...>, @metrics={}, @metrics_lock=#<Mutex:0x5f35a293>>, @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x3a4491ba>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0xd501d0c @lock=#<Mutex:0x6a305a8>, @io=#<IO:/var/log/logstash/indexer.log>>}, @level=:info>, @last_flush_cycle=2013-03-13 13:19:40 +0000, @config={"path"=>"/var/log/logstash/indexer.event.log", "type"=>"", "tags"=>[], "exclude_tags"=>[], "fields"=>[], "flush_interval"=>2, "gzip"=>false}, @files={}, @path="/var/log/logstash/indexer.event.log", @stale_cleanup_interval=10, @flush_interval=2, @exclude_tags=[]>, :level=>:info}
{:message=>"Output registered", :plugin=>#<LogStash::Outputs::ElasticSearchHTTP:0x5d6a8ef1 @document_id=nil, @fields=[], @type="", @tags=[], @index_type="%{@type}", @host="localhost", @params={"host"=>"localhost", "port"=>9200, "flush_size"=>1, "type"=>"", "tags"=>[], "exclude_tags"=>[], "fields"=>[], "index"=>"logstash-%{+YYYY.MM.dd}", "index_type"=>"%{@type}", "document_id"=>nil}, @flush_size=1, @logger=#<LogStash::Logger:0x3be5824e @target=#<IO:/var/log/logstash/indexer.log>, @subscriber_lock=#<Mutex:0x58cded9a>, @metrics=#<Cabin::Metrics:0x37aa4702 @channel=#<Cabin::Channel:0xc1bf0db @subscriber_lock=#<Mutex:0x7e61c012>, @data={}, @metrics=#<Cabin::Metrics:0x43891e90 @channel=#<Cabin::Channel:0xc1bf0db ...>, @metrics={}, @metrics_lock=#<Mutex:0x5f35a293>>, @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x3a4491ba>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0xd501d0c @lock=#<Mutex:0x6a305a8>, @io=#<IO:/var/log/logstash/indexer.log>>}, @level=:info>, @port=9200, @config={"host"=>"localhost", "port"=>9200, "flush_size"=>1, "type"=>"", "tags"=>[], "exclude_tags"=>[], "fields"=>[], "index"=>"logstash-%{+YYYY.MM.dd}", "index_type"=>"%{@type}", "document_id"=>nil}, @index="logstash-%{+YYYY.MM.dd}", @agent=#<FTW::Agent:0x7ecea020 @certificate_store=#<OpenSSL::X509::Store:0x2f72d5ea @error_string=nil, @trust=0, @flags=0, @verify_callback=nil, @chain=nil, @time=nil, @purpose=0, @error=nil>, @pool=#<FTW::Pool:0x1c3a0dfc @lock=#<Mutex:0x276c29de>, @pool={}>, @configuration={"redirection-limit"=>20, "ssl.trustdb"=>"/usr/share/logstash/.ftw/ssl-trust.db"}, @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>>, @queue=[], @exclude_tags=[]>, :level=>:info}
{:message=>"All plugins are started and registered.", :level=>:info}
{:message=>"Opening file", :path=>"/var/log/logstash/indexer.event.log", :level=>:info}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.778Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:15+00:00 localhost sudo: vagrant : TTY=pts/4 ; PWD=/home/vagrant ; USER=root ; COMMAND=/usr/bin/tail -F /var/log/lumberjack/syslog.log", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.780Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:15+00:00 localhost sudo: pam_unix(sudo:session): session opened for user root by vagrant(uid=1000)", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.781Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaakspöldöls", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.783Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:45:50+00:00 localhost syslog-ng[17054]: Log statistics; processed='destination(d_error)=9', processed='destination(d_debug)=0', processed='center(received)=0', processed='src.internal(s_src#1)=22', stamp='src.internal(s_src#1)=1363171502', processed='destination(d_mail)=20', processed='destination(d_cron)=0', processed='destination(d_auth)=17', processed='destination(d_syslog)=171', processed='center(queued)=0', processed='destination(d_console)=0', processed='destination(d_user)=1', processed='global(payload_reallocs)=2', processed='global(sdata_updates)=0', processed='destination(d_uucp)=0', processed='destination(d_kern)=4', processed='global(msg_clones)=0', processed='source(s_src)=211', processed='destination(d_lpr)=0'", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.785Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:21+00:00 localhost twitter[18038]: Pocahontaas_J - UlQgQGRpaWFtb25kY2VyaXNlczogQXUgdMOpbMOpcGhvbmUgb24gbWUgcHJvcG9zZSA34oKsNDcgISBBTExFWiBBTExFWiBGQUlURVMgTU9OVEVSIExFUyBFTkNIw4hSRVMgISEh", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.788Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:23+00:00 localhost twitter[18038]: kinako0382 - QGtlaTEwOTgwNDgg5rex5aSc44GL44GB4oCm4oCmIOS7iuW6puOBiuS8keOBv+WJjeOBq+OBjOOCk+OBsOOBo+OBpuOBv+OBvuOBme+8gQ==", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.789Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:26+00:00 localhost twitter[18038]: RitaIndriyani3 - SXlhICxrZW5hcGEgPyBSVCBAQW50b1lvbmdhOiBAUml0YUluZHJpeWFuaTMgaGFp", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.791Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:28+00:00 localhost twitter[18038]: ChattySongz - QmFuZGUgZCdpbXBvbGllcyAhISBKZSB2b3VzIGFpIHBvc2VyIHVuZSBxdWVzdGlvbiwgcsOpcG9uZGV6IG1vaQ==", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.798Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:30+00:00 localhost twitter[18038]: carneirocop - QEJvbmVraW5oYXN0ZSAjIGJvbSBkaWEgbWV1IGFuam8gIQ==", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.805Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:32+00:00 localhost twitter[18038]: AnwarJohari - QGFhbndhcmljIGFoYWFhLiBXZSBidXkgbG9yaGhoaA==", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:33.807Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:34+00:00 localhost twitter[18038]: nicoleabarro - VGhlIHN1bW1lciBJIHR1cm5lZCBwcmV0dHkuLi4=", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:40.814Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:37+00:00 localhost twitter[18038]: dokukinoko758 - 6Jek44GP44KT44KC44KE44Gw44GL44Gj44Gf77yB77yB77yB77yB77yB77yB77yB", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:40.928Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:39+00:00 localhost twitter[18038]: isco29 - QHJpc3phdGlhbnN5YWggWXVrIE1hcmkgaWt1dGFuISBIYWRpYWggQmxhY2tCZXJyeSArIHB1bHNhIDUgdGFodW4gbWVudW5nZ3UhIERhZnRhciBkaTogaHR0cHM6Ly90LmNvLzU4WTNNMkxlejA=", "@type"=>"syslog"}
{"@source"=>"lumberjack://precise-amd64//var/log/syslog", "@tags"=>["_grokparsefailure"], "@fields"=>{"syslog_severity_code"=>5, "syslog_facility_code"=>1, "syslog_facility"=>"user-level", "syslog_severity"=>"notice"}, "@timestamp"=>"2013-03-13T13:19:40.981Z", "@source_host"=>"precise-amd64", "@source_path"=>"//var/log/syslog", "@message"=>"2013-03-13T10:46:43+00:00 localhost twitter[18038]: oleehreal - OjrYpdi52KfYr9ipINmG2LTYsTo62YHZitinIDog2KfZhtiq2YfYqiDYp9mE2YXZh9mF2Kkg2KfZhNi02KfZgtipICA6INiu2LHYrCDYp9mE2YXZh9in2KzZhSDYp9mE2KXYs9io2KfZhtmKINiv2YrZgdmK2K8g2YHZitinINmF2YfYp9is2YUg2YHYsdmK2YIgLi4uIGh0dHA6Ly90LmNvL0pyZmNXZ2dZWE0=", "@type"=>"syslog"}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x55e3f424 @headers=FTW::HTTP::Headers <{"content-type"=>"application/json; charset=UTF-8", "content-length"=>"192"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"{\"error\":\"MapperParsingException[Failed to parse [@type]]; nested: JsonParseException[Unexpected end-of-input in VALUE_STRING\\n at [Source: [B@22db233c; line: 1, column: 807]]; \",\"status\":400}", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x58b8fac1 @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x45eae7eb @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x442d689e @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x2598ec2f @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x7e899e2e @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x51adb64c @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x58b3e209 @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0xe603179 @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x11e11ad5 @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x294a9607 @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
{:message=>"Error writing to elasticsearch", :response=>#<FTW::Response:0x4cc66f9f @headers=FTW::HTTP::Headers <{"content-type"=>"text/plain; charset=UTF-8", "content-length"=>"71"}>, @body=<FTW::Connection(@3934) @destinations=["localhost:9200"] @connected=true @remote_address="127.0.0.1" @secure=false >, @status=400, @reason="Bad Request", @logger=#<Cabin::Channel:0x3133637 @subscriber_lock=#<Mutex:0x624c5674>, @data={}, @metrics=#<Cabin::Metrics:0x1c00c17 @channel=#<Cabin::Channel:0x3133637 ...>, @metrics={}, @metrics_lock=#<Mutex:0x6759bae6>>, @subscribers={}, @level=:info>, @version=1.1>, :response_body=>"No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]", :level=>:error}
Raw
Wireshark Trace
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
No handler found for uri [/logstash-2013.03.13/syslog] and method [GET]POST /logstash-2013.03.13/syslog HTTP/1.1
host: localhost
connection: keep-alive
content-length: 403
{"@source":"lumberjack://precise-amd64//var/log/syslog","@tags":["_grokparsefailure"],"@fields":{"syslog_severity_code":5,"syslog_facility_code":1,"syslog_facility":"user-level","syslog_severity":"notice"},"@timestamp":"2013-03-13T13:01:01.499Z","@source_host":"precise-amd64","@source_path":"//var/log/syslog","@message":"2013-03-13T10:45:38+00:00 localhost vagrant: fjsajaaksp..ld..ls","@type":"syslog"}HTTP/1.1 400 Bad Request
Content-Type: text/plain; charset=UTF-8
Content-Length: 71
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment