Hi @ all,
we'll test the Hadoop Monitoring APP.
- installation is complete, got events in 2 index, like hadoopmon_os & hadoopmon_metrics.
- the index hadoopmon_os seams to work correctly (shows "interested fields")
- the index hadoopmon_metrics got RAW events but without interested fields
samle of inputsconf of the Forwarder installation
for index hadoopmon_metrics
# [monitor:///hadoop/logs/hadoop/hdfs/hadoop-hdfs-namenode*.log] # index = hadoopmon_metrics # sourcetype = hadoop_namenode # disabled = 0 # [monitor:///hadoop/logs/hadoop/hdfs/hadoop-hdfs-namenode*.out] # index = hadoopmon_metrics # sourcetype = hadoop_namenode # disabled = 0
Scripted inputs for index hadoopmon_os works fine
Has someone an idea to got fields / extraction of RAW data?
thanks in advance
if you are using app then it is in
Well, I Installed Hadoop monitoring app on my local system, and there are no field extractions for the mentioned sourcetypes. So you need to extract it manually. There are field extractions only for OS scripted inputs.
let me know if this helps!
I downvoted this post because not helpful, because it doesn't make sense when i'm looking for using the preinstalled frondend. there searches like
You are looking for a saved search that you will find in
in which they have defined
display.events.fields = ["host","source","sourcetype","APPID","CONTAINERID","OPERATION","RESULT","USER","TARGET"]
And you should not downvote the post unless it harms your system.
thanks for the TIP,
so I agree that the saved search is there,
but why the following line doesn't work?
when I' looking for "index=hadoopmon_metrics sourcetype=hadoop_resourcemanager" there no field extractions just like "appId"
do you have data in your test inv?
cheers, and so sry for downvoting
No, I do not have sample data for this, are you running
index=hadoopmon_metrics sourcetype=hadoop_resourcemanager in verbose mode?
I am quite sure you are running it in fast mode where you mostly will not see all the fields.
Below time picker can you see three modes? verbose mode will give you all the fields.