[Hindsight] nginx access logs

Tomas Barton barton.tomas at gmail.com
Thu Apr 6 19:28:29 UTC 2017


Hi,

I'm trying to parse nginx logs with hindsight. The lua plugin for parsing
logs is located in

/usr/lib/luasandbox/io_modules/decoders/nginx/access.lua

I've tried to configure hindsight's io_path:

io_lua_path             = analysis_lua_path ..
 ";/usr/lib/luasandbox/io_modules/?.lua" ..
";/usr/lib/luasandbox/io_modules/decoders/nginx/?.lua"

however it still won't load the module.

1491506654996209062 [info] hindsight starting
1491506654999944039 [info] input.tcp starting
1491506655000061755 [error] input_plugins input.access failed to find the
specified lua filename: access.lua
1491506655000085056 [error] input_plugins access.cfg create_inputs_plugin
failed
1491506655003295853 [info] input.socket starting
1491506655003484631 [info] analysis_plugins starting thread: 0
1491506655003610530 [debug] input_reader analysis0 opened file: cache/

What am I doing wrong? Obviously I can't include folder in plugin filename.
Is there some naming convention I'm missing?


Here's the input plugin configuration:

filename = "access.lua"
instruction_limit = 0
input_file = "nginx_access.log"
preserve_data = true

decoders_nginx_access = {
  log_format = '$remote_addr - $remote_user [$time_local] "$request"
$status $body_bytes_sent "$http_referer" "$http_user_agent"',

}


Thanks,
Tomas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/hindsight/attachments/20170406/b940494e/attachment.html>


More information about the Hindsight mailing list