Commit graph

3618 commits

Author SHA1 Message Date
Pete Fritchman
8b7b1b4623 - use proper variable name for termination callback block 2009-11-08 06:31:37 +00:00
Jordan Sissel
3a02fb6abd - migrate up some code 2009-11-08 06:14:46 +00:00
Jordan Sissel
1c5c6b8c03 - don't require a file we don't have naymore 2009-11-08 06:10:15 +00:00
Pete Fritchman
2a4e947c34 - don't start up a File::Tail::Since until the file exists
- if File::Tail::Since does exit, we want to know about it
2009-11-08 05:18:48 +00:00
Pete Fritchman
fff7413057 - gracefully handle errors from log parsers
+ they can throw a LogStash::Log::LogParseError now
- handle JSON parse exceptions
2009-11-08 05:07:12 +00:00
Jordan Sissel
e838dfaee4 - Remove old SlidingWindowSet code that MQRPC replaced with SizedThreadSafeHash 2009-11-07 23:43:39 +00:00
Jordan Sissel
8c22b1f314 - Style 2009-11-07 22:37:38 +00:00
Jordan Sissel
445eada3e2 - use Util::collapse 2009-11-07 22:36:39 +00:00
Jordan Sissel
b22506fa17 - style fix 2009-11-07 22:34:30 +00:00
Jordan Sissel
50eb137e1e - Use mqrpc's new 'delayable' message header 2009-11-07 21:58:40 +00:00
Jordan Sissel
c234e01f38 - Messages sent from parser -> indexer that came from an IndexEventRequest now
get pushed into a queue that is managed by a separate thread. This is
  necessary to prevent sendmsg() from blocking the main AMQP reader thread when
  sendmsg() might block due to sliding window closure.

  This queue length is unchecked, however, the correct fix is to unsubscribe
  from the input (the AMQP queue) and only resubscribe once our queue has
  cleared a bit.
2009-11-06 10:16:44 +00:00
Jordan Sissel
5e51250c20 - before forwarding the indexeventrequest to the indexer, generate a new
message id for it.
2009-11-06 09:39:39 +00:00
Jordan Sissel
ef35581319 - disable agent index request buffering for now (need to debug parser race/halting-bug condition)
- set response code in Indexer's IndexEventRequestHandler
2009-11-06 09:32:01 +00:00
Jordan Sissel
c9fa9c87af - BaseConfig subclasses MQRPC::Config now
- Update servers and clients to use MQRPC properly
2009-11-06 08:57:20 +00:00
Jordan Sissel
790b081a31 - Move all messages to use MQRPC 2009-11-06 08:26:47 +00:00
Jordan Sissel
1f85aad3d5 - Purge old network code now implemented by MQRPC 2009-11-06 08:17:13 +00:00
Jordan Sissel
728221d326 - Add #searchhits to the search client. Takes a log type and array of queries,
returns a hash of query => hitcount
- Fix LogStash::Operation behavior. If 'wait_until_finish' was called after the
  operation finished, not before, we would deadlock. Now any wait_until_finish
  call will succeed and return immediately if the operation has already finished.
  It will still block normally if the operation has not finished.
- Comment-out the sliding window stuff
- Add 'graphpoints' action for the web. Querying this will return an array of
  [timestamp_in_ms, hits] for the query for some period of timestamps for your
  query. Makes happy use of the Operation class so we can send a pile of search
  requests in parallel and wait until they finish. 24 queries (one for every
  hour) takes less than a second.
2009-10-28 08:21:14 +00:00
Jordan Sissel
8b826e5215 - Attempt to use sliding windows 2009-10-26 18:54:40 +00:00
Jordan Sissel
0e68c317cb - Add my attempt at a locking 'sliding window' class that would prevent
new additions if the 'want' buffer was full.
2009-10-26 06:20:56 +00:00
Jordan Sissel
03707d1e20 - set durable on queues 2009-10-26 06:16:55 +00:00
Jordan Sissel
5dcd3ff22f - we should send a reply to the client sending the indexrequest 2009-10-26 06:14:11 +00:00
Jordan Sissel
4e9eb6ae28 - write File::Tail::Since state per file to ~/.rb_since_d/uid.filepath
This relieves contention for the single ~/.rb_since file

  Also try to write to /var/run/rb_since/uid.filepath first, if we can.
2009-10-25 09:41:36 +00:00
Jordan Sissel
9af8615fe0 - Support message buffering again, but now support both buffering and
non-buffering (ie; send message now). This is akin to TCP_NODELAY but is
  configurable on a per-message basis by calling 'message.want_buffer(true)'
2009-10-25 04:29:06 +00:00
Jordan Sissel
f35a1ea88a - Follow symlink if pattern_dir is one 2009-10-25 04:27:27 +00:00
Jordan Sissel
226027c024 - Disable message buffering internal to logstash. Previously, sendmsg() would
push into an array which would get flushed when full or once per second.
  This was causing any normally-fast search request to take a minimum of 1 second.

  The original need for buffering was due to features of STOMP (not used
  anymore) that would limit the number of messages we could handle at once. We
  would buffer multiple messages to a single STOMP queue message so that we
  could handle multiple messages. This may not be a problem anymore with AMQP.

  Set BUFFER_DELAY_MESSAGES to true in socket.rb if you want to re-enable this.

- Add 'timestamp' attribute for all messages. This attribute is set
  automatically when it is sent with MessageSocket#sendmsg.
- Add blocking on MessageSocket#initialize to wait for the AMQP thread. Uses
  the same mutex/conditionvariable method we use to block LogStash::Operation
  instances.
- Removed old 'USE_MARSHAL' support as I think we're pretty happy with JSON now.
2009-10-25 03:24:02 +00:00
Jordan Sissel
646a0948ed - Add LogStash::StopWatch class for recording execution time of code 2009-10-25 03:14:42 +00:00
Jordan Sissel
9195abd6de - make get_ferret open a new IndexReader and Searcher every time, otherwise we
can get stale search results.
2009-10-23 10:07:10 +00:00
Jordan Sissel
bb22cf63b7 - purge stomp 2009-10-21 08:30:45 +00:00
Jordan Sissel
4a3d5f2e8b - explicitly catch Ferret::FileNotFound 2009-10-21 02:47:53 +00:00
Pete Fritchman
04d2cee11e - fix pid/dying? logic
- handle exceptions from get_ferret (trying to search unindexed log types)
- die if we can't create a new index
2009-10-21 02:38:26 +00:00
Jordan Sissel
af918884c9 - default search query includes 'AND -@NEEDSPARSING:1' unless we have
@NEEDSPARSING in the query
2009-10-21 02:19:36 +00:00
Jordan Sissel
1b7e57b8d0 - Update Clients::Search to block on the search ops.
Clients::Search#search now returns [hits, results_array]
2009-10-21 02:06:38 +00:00
Jordan Sissel
a35abbbdad - factor out search client
- make web and bin/search.rb use the new search client class
2009-10-21 01:58:42 +00:00
Jordan Sissel
21f04f4e8b - remove debugging
- abort if @daemonize and no @logfile set
2009-10-21 01:00:26 +00:00
Jordan Sissel
1ac4ed62a6 - facter out common program activities to LogStash::Program 2009-10-21 00:41:32 +00:00
Pete Fritchman
8b32b04aea - start using config values for connecting to the broker
- print some warnings when we are reconnecting to the broker (could be
  indicative of bad MQ settings)
2009-10-21 00:36:11 +00:00
Pete Fritchman
dc27987d9e - ENV["LOGSTASH_DIR"] is deprecated. 2009-10-20 23:52:40 +00:00
Pete Fritchman
b9f811eea5 - fix pattern_dir support (again)
- some defaults
2009-10-20 20:50:02 +00:00
Pete Fritchman
7e7dc90cfa - proper support for pattern_dir 2009-10-20 20:37:57 +00:00
Pete Fritchman
24169ef165 - refactor agent to be a real daemon
- refactor configs (all inherit from BaseConfig)
- move beef of agent code to lib/net/clients/
- use optionparser's ".order" instead of ".parse"
2009-10-20 17:40:44 +00:00
Pete Fritchman
8a332a01e2 - logstash_dir is where we write stuff. not necessarily where our patterns
are installed, so allow pattern_dir.
2009-10-20 04:06:44 +00:00
Pete Fritchman
d4459ebf46 - consolidate to one logstashd that forks parsers & indexers
- use logger for output
- stop handling QuitRequests
- re-up broadcast interval to 30 (was @ 5 for debugging)
- add debug output (logstashd -d ...)
2009-10-19 19:03:49 +00:00
Jordan Sissel
e8159ef438 - remove debugging 2009-10-19 10:21:59 +00:00
Jordan Sissel
bff4949129 - responses should always have the same id as the request. 2009-10-19 10:21:49 +00:00
Jordan Sissel
e1839d359d - Add ability to do synchronous-like messaging:
op = client.sendmsg("logstash-directory", msg) do |response|
    puts response
    :finished
  end

  op.wait_until_finished
  puts "Done!"

  If Socket#sendmsg is given a block, it will return an Operation that is
  useful shown above.
2009-10-19 10:06:39 +00:00
Jordan Sissel
cd4baf78a6 - move amqp/em into a separate thread.
- Things wanting to block until amqp/em are finished will still call
  Socket#run, which now only blocks until the new amqp/em thread complete (with
  Thread#join)
2009-10-19 08:57:43 +00:00
Pete Fritchman
4afa19646b - include log_type in a LogKeysResponse message 2009-10-19 07:42:10 +00:00
Pete Fritchman
4755c0ae1c - add ability to query what keys are available for a log type
- cache indexreaders, searchers, and queryparsers
2009-10-19 07:09:07 +00:00
Pete Fritchman
6c4c36cdd7 - support querying what log types are available 2009-10-19 06:56:07 +00:00
Pete Fritchman
344e1a4aef - send back [@DATE, @LINE] in search results so we can collate results
from multiple indexers
2009-10-19 06:27:31 +00:00