My ouputs conf looks like this:
defaultgroup = logstash
disabled = false
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.blacklist = (_audit|_internal|_introspection)
sendCookedData = false
useACK = true
As well as my actual events, I'm seeing loads of messages being emitted like this:
INFO Metrics - group=thruput, name=uncooked_output, instantaneous_kbps=0.176377, instantaneous_eps=0.096773, average_kbps=0.355449, total_k_processed=44.000000, kb=5.467773, ev=3.000000
INFO Metrics - group=thruput, name=thruput, instantaneous_kbps=0.176377, instantaneous_eps=0.096773, average_kbps=0.371606, total_k_processed=46.000000, kb=5.467773, ev=3.000000, load_average=0.030000
INFO Metrics - group=thruput, name=cooked_output, instantaneous_kbps=0.000000, instantaneous_eps=0.000000, average_kbps=0.000000, total_k_processed=0.000000, kb=0.000000, ev=0.000000
INFO Metrics - group=tcpout_connections, name=logstash:127.0.0.1:7777:0, sourcePort=8090, destIp=127.0.0.1, destPort=7777, _tcp_Bps=186.73, _tcp_KBps=0.18, _tcp_avg_thruput=0.39, _tcp_Kprocessed=46, _tcp_eps=0.10, kb=5.47
How can I eliminate these from the forwarder output?
... View more
I've already typed this once, but for some reason it's disappeared.
The problem seems to stem from Line 377 of ModularInput.StateCheckerThread which makes a REST call to splunk to determine whether the input is enable. As it's a local instance with a default SSL cert the connection fails the SSL verification and throws an exception, causing the input to assume it's disabled (why?) and throw away all the messages (why again?)
This does not (AFAICT) appear in any logs, nor does there appear to be any way of overriding it.
How can we get this to work?
... View more