There are two configuration files that elastic search uses. One is for general elasticsearch functionality (elasticsearch.yml) and the other is specific to logging. I want to be able to control the logging of the elasticsearch instance that is being launched by syslog-ng. Since the syslog-ng documentation states that you can have a list of resources seperated by ";" I thought I could use the logging.yml file as well.



On 06/07/2016 08:56 PM, Budai, László wrote:
Hi,

is that possible to set multiple resources for a node? We can use only one resource file.

What is your use case that needs this feature? Maybe you have splitted resource files and what we should have to do is just merge the files into a single resource file?


Laszlo Budai

On Tuesday, June 7, 2016, Evan Rempel <erempel@uvic.ca> wrote:
I have   the elasticsearch destination working correctly, but if I try to use multiple rsources, I get an error


destination d_elasticsearch_0 {
  elasticsearch(
    index("flare-${YEAR}.${MONTH}.${DAY}.${HOUR}")
    type("flare")
    cluster("es-dcs-dev")
    client_mode("node")
    flush_limit("10000")
    template("$MESSAGE                    ")
    resource("/etc/elasticsearch/elasticsearch.yml")
  );
};


works fine, but if I add a second resource

destination d_elasticsearch_0 {
  elasticsearch(
    index("flare-${YEAR}.${MONTH}.${DAY}.${HOUR}")
    type("flare")
    cluster("es-dcs-dev")
    client_mode("node")
    flush_limit("10000")
    template("$MESSAGE                    ")
    resource("/etc/elasticsearch/elasticsearch.yml;/etc/elasticsearch/logging.yml")
  );
};

I get an error

Starting system logger (syslog-ng.esgateway): [2016-06-07T09:01:58.694633] org.syslog_ng.elasticsearch_v2.client.ESNodeClient.loadConfigFile:69 - Can't load settings from file, file = '/etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/logging.yml', reason = 'Failed to open stream for url [/etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/logging.yml]';


Can anyone shed some light on how to configure multiple resources?

-- 
Evan


______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq