From 0a217c3564303265d8869ff1852edb1586c4e9ea Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 26 Feb 2020 14:59:35 -0600 Subject: [PATCH] Improve ECS categorization field mapping in kafka module - event.kind - event.type - convert pipeline to yaml Closes #16167 --- CHANGELOG.next.asciidoc | 1 + .../module/kafka/log/ingest/pipeline.json | 87 -------- filebeat/module/kafka/log/ingest/pipeline.yml | 73 +++++++ filebeat/module/kafka/log/manifest.yml | 2 +- .../test/controller-2.0.0.log-expected.json | 44 ++++ .../log/test/controller.log-expected.json | 40 ++++ .../log/test/server-2.0.0.log-expected.json | 200 ++++++++++++++++++ .../kafka/log/test/server.log-expected.json | 40 ++++ .../test/state-change-1.1.0.log-expected.json | 2 + .../test/state-change-2.0.0.log-expected.json | 2 + .../log/test/state-change.log-expected.json | 2 + 11 files changed, 405 insertions(+), 88 deletions(-) delete mode 100644 filebeat/module/kafka/log/ingest/pipeline.json create mode 100644 filebeat/module/kafka/log/ingest/pipeline.yml diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c5a2e2046d4..c5c6a844d8d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -147,6 +147,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Improve ECS field mappings in aws module. {issue}16154[16154] {pull}16307[16307] - Improve ECS categorization field mappings in googlecloud module. {issue}16030[16030] {pull}16500[16500] - Improve ECS field mappings in haproxy module. {issue}16162[16162] {pull}16529[16529] +- Improve ECS categorization field mapping in kafka module. {issue}16167[16167] {pull}16645[16645] *Heartbeat* diff --git a/filebeat/module/kafka/log/ingest/pipeline.json b/filebeat/module/kafka/log/ingest/pipeline.json deleted file mode 100644 index 6ba84de7634..00000000000 --- a/filebeat/module/kafka/log/ingest/pipeline.json +++ /dev/null @@ -1,87 +0,0 @@ -{ - "description": "Pipeline for parsing Kafka log messages", - "processors": [ - { - "grok": { - "field": "message", - "trace_match": true, - "patterns": [ - "(?m)%{TIMESTAMP_ISO8601:kafka.log.timestamp}. %{LOGLEVEL:log.level} +%{JAVALOGMESSAGE:message} \\(%{JAVACLASS:kafka.log.class}\\)$[ \\n]*(?'kafka.log.trace.full'.*)" - ] - } - }, - { - "grok": { - "field": "message", - "pattern_definitions": { - "KAFKA_COMPONENT": "[^\\]]*" - }, - "patterns": [ - "\\[%{KAFKA_COMPONENT:kafka.log.component}\\][,:.]? +%{JAVALOGMESSAGE:message}" - ], - "on_failure": [ - { - "set": { - "field": "kafka.log.component", - "value": "unknown" - } - } - ] - } - }, - { - "grok": { - "field": "kafka.log.trace.full", - "ignore_missing": true, - "patterns": [ - "%{JAVACLASS:kafka.log.trace.class}:\\s*%{JAVALOGMESSAGE:kafka.log.trace.message}" - ], - "on_failure": [ - { - "remove": { - "field": "kafka.log.trace" - } - } - ] - } - }, - { - "remove": { - "field": "kafka.log.trace.full", - "ignore_missing": true - } - }, - { - "rename": { - "field": "@timestamp", - "target_field": "event.created" - } - }, - { - "date": { - "if": "ctx.event.timezone == null", - "field": "kafka.log.timestamp", - "target_field": "@timestamp", - "formats": ["yyyy-MM-dd HH:mm:ss,SSS"], - "on_failure": [{"append": {"field": "error.message", "value": "{{ _ingest.on_failure_message }}"}}] - } - }, - { - "date": { - "if": "ctx.event.timezone != null", - "field": "kafka.log.timestamp", - "target_field": "@timestamp", - "formats": ["yyyy-MM-dd HH:mm:ss,SSS"], - "timezone": "{{ event.timezone }}", - "on_failure": [{"append": {"field": "error.message", "value": "{{ _ingest.on_failure_message }}"}}] - } - }, - {"remove": {"field": "kafka.log.timestamp" }} - ], - "on_failure" : [{ - "set" : { - "field" : "error.log", - "value" : "{{ _ingest.on_failure_message }}" - } - }] -} diff --git a/filebeat/module/kafka/log/ingest/pipeline.yml b/filebeat/module/kafka/log/ingest/pipeline.yml new file mode 100644 index 00000000000..41db8f4f197 --- /dev/null +++ b/filebeat/module/kafka/log/ingest/pipeline.yml @@ -0,0 +1,73 @@ +description: Pipeline for parsing Kafka log messages +processors: +- grok: + field: message + trace_match: true + patterns: + - (?m)%{TIMESTAMP_ISO8601:kafka.log.timestamp}. %{LOGLEVEL:log.level} +%{JAVALOGMESSAGE:message} + \(%{JAVACLASS:kafka.log.class}\)$[ \n]*(?'kafka.log.trace.full'.*) +- grok: + field: message + pattern_definitions: + KAFKA_COMPONENT: '[^\]]*' + patterns: + - \[%{KAFKA_COMPONENT:kafka.log.component}\][,:.]? +%{JAVALOGMESSAGE:message} + on_failure: + - set: + field: kafka.log.component + value: unknown +- grok: + field: kafka.log.trace.full + ignore_missing: true + patterns: + - '%{JAVACLASS:kafka.log.trace.class}:\s*%{JAVALOGMESSAGE:kafka.log.trace.message}' + on_failure: + - remove: + field: kafka.log.trace +- remove: + field: kafka.log.trace.full + ignore_missing: true +- rename: + field: '@timestamp' + target_field: event.created +- date: + if: ctx.event.timezone == null + field: kafka.log.timestamp + target_field: '@timestamp' + formats: + - yyyy-MM-dd HH:mm:ss,SSS + on_failure: + - append: + field: error.message + value: '{{ _ingest.on_failure_message }}' +- date: + if: ctx.event.timezone != null + field: kafka.log.timestamp + target_field: '@timestamp' + formats: + - yyyy-MM-dd HH:mm:ss,SSS + timezone: '{{ event.timezone }}' + on_failure: + - append: + field: error.message + value: '{{ _ingest.on_failure_message }}' +- remove: + field: kafka.log.timestamp +- set: + field: event.kind + value: event +- script: + lang: painless + source: >- + def errorLevels = ["ERROR", "FATAL"]; + if (ctx?.log?.level != null) { + if (errorLevels.contains(ctx.log.level)) { + ctx.event.type = "error"; + } else { + ctx.event.type = "info"; + } + } +on_failure: +- set: + field: error.log + value: '{{ _ingest.on_failure_message }}' diff --git a/filebeat/module/kafka/log/manifest.yml b/filebeat/module/kafka/log/manifest.yml index 97ea201ec89..38107e02ab8 100644 --- a/filebeat/module/kafka/log/manifest.yml +++ b/filebeat/module/kafka/log/manifest.yml @@ -10,5 +10,5 @@ var: - "{{.kafka_home}}/logs/state-change.log*" - "{{.kafka_home}}/logs/kafka-*.log*" -ingest_pipeline: ingest/pipeline.json +ingest_pipeline: ingest/pipeline.yml input: config/log.yml diff --git a/filebeat/module/kafka/log/test/controller-2.0.0.log-expected.json b/filebeat/module/kafka/log/test/controller-2.0.0.log-expected.json index 40e888a364f..42dd99ab2a2 100644 --- a/filebeat/module/kafka/log/test/controller-2.0.0.log-expected.json +++ b/filebeat/module/kafka/log/test/controller-2.0.0.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2018-10-31T15:03:32.474-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -16,8 +18,10 @@ { "@timestamp": "2018-10-31T15:03:32.474-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -30,8 +34,10 @@ { "@timestamp": "2018-10-31T15:03:32.474-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -44,8 +50,10 @@ { "@timestamp": "2018-10-31T15:03:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -58,8 +66,10 @@ { "@timestamp": "2018-10-31T15:03:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -72,8 +82,10 @@ { "@timestamp": "2018-10-31T15:03:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -86,8 +98,10 @@ { "@timestamp": "2018-10-31T15:03:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -100,8 +114,10 @@ { "@timestamp": "2018-10-31T15:03:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -114,8 +130,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -128,8 +146,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -142,8 +162,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -156,8 +178,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -170,8 +194,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -184,8 +210,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -198,8 +226,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -212,8 +242,10 @@ { "@timestamp": "2018-10-31T15:08:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -226,8 +258,10 @@ { "@timestamp": "2018-10-31T15:09:30.306-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -240,8 +274,10 @@ { "@timestamp": "2018-10-31T15:09:30.307-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -254,8 +290,10 @@ { "@timestamp": "2018-10-31T15:09:30.396-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.RequestSendThread", @@ -268,8 +306,10 @@ { "@timestamp": "2018-10-31T15:09:30.397-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.RequestSendThread", @@ -282,8 +322,10 @@ { "@timestamp": "2018-10-31T15:09:30.396-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.RequestSendThread", @@ -296,8 +338,10 @@ { "@timestamp": "2018-10-31T15:13:32.475-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", diff --git a/filebeat/module/kafka/log/test/controller.log-expected.json b/filebeat/module/kafka/log/test/controller.log-expected.json index 46c9226208e..4b4005c5300 100644 --- a/filebeat/module/kafka/log/test/controller.log-expected.json +++ b/filebeat/module/kafka/log/test/controller.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2017-08-04T10:48:21.048-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.ControllerEventManager$ControllerEventThread", @@ -16,8 +18,10 @@ { "@timestamp": "2017-08-04T10:48:21.063-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -30,8 +34,10 @@ { "@timestamp": "2017-08-04T10:48:21.064-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -44,8 +50,10 @@ { "@timestamp": "2017-08-04T10:48:21.082-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -58,8 +66,10 @@ { "@timestamp": "2017-08-04T10:48:21.085-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -72,8 +82,10 @@ { "@timestamp": "2017-08-04T10:48:21.154-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.ReplicaStateMachine", @@ -86,8 +98,10 @@ { "@timestamp": "2017-08-04T10:48:21.156-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.PartitionStateMachine", @@ -100,8 +114,10 @@ { "@timestamp": "2017-08-04T10:48:21.157-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -114,8 +130,10 @@ { "@timestamp": "2017-08-04T10:48:21.165-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.PartitionStateMachine", @@ -128,8 +146,10 @@ { "@timestamp": "2017-08-04T11:44:22.588-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -142,8 +162,10 @@ { "@timestamp": "2017-08-04T11:44:25.094-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.ControllerEventManager$ControllerEventThread", @@ -156,8 +178,10 @@ { "@timestamp": "2017-08-04T11:44:25.095-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.ControllerEventManager$ControllerEventThread", @@ -170,8 +194,10 @@ { "@timestamp": "2017-08-04T11:44:25.097-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.ControllerEventManager$ControllerEventThread", @@ -184,8 +210,10 @@ { "@timestamp": "2017-08-04T11:44:25.099-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -198,8 +226,10 @@ { "@timestamp": "2017-08-04T11:44:25.100-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.KafkaController", @@ -212,8 +242,10 @@ { "@timestamp": "2017-08-04T11:44:25.105-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.PartitionStateMachine", @@ -226,8 +258,10 @@ { "@timestamp": "2017-08-04T11:44:25.111-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.ReplicaStateMachine", @@ -240,8 +274,10 @@ { "@timestamp": "2017-08-04T11:44:25.112-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.RequestSendThread", @@ -254,8 +290,10 @@ { "@timestamp": "2017-08-04T11:44:25.112-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.RequestSendThread", @@ -268,8 +306,10 @@ { "@timestamp": "2017-08-04T11:44:25.113-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.controller.RequestSendThread", diff --git a/filebeat/module/kafka/log/test/server-2.0.0.log-expected.json b/filebeat/module/kafka/log/test/server-2.0.0.log-expected.json index 4402a7d39c4..d1a8d287cb0 100644 --- a/filebeat/module/kafka/log/test/server-2.0.0.log-expected.json +++ b/filebeat/module/kafka/log/test/server-2.0.0.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2018-10-17T12:04:41.718-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -16,8 +18,10 @@ { "@timestamp": "2018-10-17T12:14:41.719-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -30,8 +34,10 @@ { "@timestamp": "2018-10-17T12:24:41.719-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -44,8 +50,10 @@ { "@timestamp": "2018-10-17T12:34:41.719-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -58,8 +66,10 @@ { "@timestamp": "2018-10-17T12:44:41.719-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -72,8 +82,10 @@ { "@timestamp": "2018-10-17T12:50:23.313-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -86,8 +98,10 @@ { "@timestamp": "2018-10-17T12:50:23.314-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -100,8 +114,10 @@ { "@timestamp": "2018-10-17T12:50:23.321-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -114,8 +130,10 @@ { "@timestamp": "2018-10-17T12:50:23.322-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -128,8 +146,10 @@ { "@timestamp": "2018-10-17T12:50:23.322-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -142,8 +162,10 @@ { "@timestamp": "2018-10-17T12:50:23.323-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -156,8 +178,10 @@ { "@timestamp": "2018-10-17T12:50:23.323-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.kafka.clients.FetchSessionHandler", @@ -170,8 +194,10 @@ { "@timestamp": "2018-10-17T12:50:23.324-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -184,8 +210,10 @@ { "@timestamp": "2018-10-17T12:50:23.331-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -198,8 +226,10 @@ { "@timestamp": "2018-10-17T12:50:23.348-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -212,8 +242,10 @@ { "@timestamp": "2018-10-17T12:50:23.348-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -226,8 +258,10 @@ { "@timestamp": "2018-10-17T12:50:23.350-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -240,8 +274,10 @@ { "@timestamp": "2018-10-17T12:50:23.351-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -254,8 +290,10 @@ { "@timestamp": "2018-10-17T12:50:23.355-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -268,8 +306,10 @@ { "@timestamp": "2018-10-17T12:50:23.360-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -282,8 +322,10 @@ { "@timestamp": "2018-10-17T12:50:23.361-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -296,8 +338,10 @@ { "@timestamp": "2018-10-17T12:50:23.421-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -310,8 +354,10 @@ { "@timestamp": "2018-10-17T12:50:23.421-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -324,8 +370,10 @@ { "@timestamp": "2018-10-17T12:50:24.508-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -338,8 +386,10 @@ { "@timestamp": "2018-10-17T12:51:56.064-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -352,8 +402,10 @@ { "@timestamp": "2018-10-17T12:51:56.091-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -366,8 +418,10 @@ { "@timestamp": "2018-10-17T12:51:56.098-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -380,8 +434,10 @@ { "@timestamp": "2018-10-17T12:51:56.104-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -394,8 +450,10 @@ { "@timestamp": "2018-10-17T12:54:31.461-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -408,8 +466,10 @@ { "@timestamp": "2018-10-17T12:54:31.481-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -422,8 +482,10 @@ { "@timestamp": "2018-10-17T12:54:31.482-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -436,8 +498,10 @@ { "@timestamp": "2018-10-17T12:54:31.483-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -450,8 +514,10 @@ { "@timestamp": "2018-10-17T12:54:31.501-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -464,8 +530,10 @@ { "@timestamp": "2018-10-17T12:54:31.504-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -478,8 +546,10 @@ { "@timestamp": "2018-10-17T12:54:31.504-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -492,8 +562,10 @@ { "@timestamp": "2018-10-17T12:54:31.508-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -506,8 +578,10 @@ { "@timestamp": "2018-10-17T12:54:31.510-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -520,8 +594,10 @@ { "@timestamp": "2018-10-17T12:54:32.043-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -534,8 +610,10 @@ { "@timestamp": "2018-10-17T12:54:32.044-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -548,8 +626,10 @@ { "@timestamp": "2018-10-17T12:54:41.719-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -562,8 +642,10 @@ { "@timestamp": "2018-10-17T12:57:17.790-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -576,8 +658,10 @@ { "@timestamp": "2018-10-17T12:57:17.809-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -590,8 +674,10 @@ { "@timestamp": "2018-10-17T12:57:17.810-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -604,8 +690,10 @@ { "@timestamp": "2018-10-17T12:57:17.812-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.LogManager", @@ -618,8 +706,10 @@ { "@timestamp": "2018-10-17T12:57:17.816-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -632,8 +722,10 @@ { "@timestamp": "2018-10-17T12:57:17.816-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Replica", @@ -646,8 +738,10 @@ { "@timestamp": "2018-10-17T12:57:17.816-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Replica", @@ -660,8 +754,10 @@ { "@timestamp": "2018-10-17T12:57:17.816-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -674,8 +770,10 @@ { "@timestamp": "2018-10-17T12:57:17.817-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Replica", @@ -688,8 +786,10 @@ { "@timestamp": "2018-10-17T12:57:17.833-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -702,8 +802,10 @@ { "@timestamp": "2018-10-17T12:57:17.833-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -716,8 +818,10 @@ { "@timestamp": "2018-10-17T12:57:17.835-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.LogManager", @@ -730,8 +834,10 @@ { "@timestamp": "2018-10-17T12:57:17.836-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Partition", @@ -744,8 +850,10 @@ { "@timestamp": "2018-10-17T12:57:17.836-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.cluster.Replica", @@ -758,8 +866,10 @@ { "@timestamp": "2018-10-17T12:57:17.837-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -772,8 +882,10 @@ { "@timestamp": "2018-10-17T12:57:17.838-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -786,8 +898,10 @@ { "@timestamp": "2018-10-17T12:57:17.839-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -800,8 +914,10 @@ { "@timestamp": "2018-10-17T12:57:17.896-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -814,8 +930,10 @@ { "@timestamp": "2018-10-17T12:57:17.897-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.Log", @@ -828,8 +946,10 @@ { "@timestamp": "2018-10-17T12:57:18.400-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "error", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -847,8 +967,10 @@ { "@timestamp": "2018-10-17T12:58:47.490-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.kafka.common.utils.LoggingSignalHandler", @@ -861,8 +983,10 @@ { "@timestamp": "2018-10-17T12:58:47.492-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.KafkaServer", @@ -875,8 +999,10 @@ { "@timestamp": "2018-10-17T12:58:47.494-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.KafkaServer", @@ -889,8 +1015,10 @@ { "@timestamp": "2018-10-17T12:58:47.547-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -903,8 +1031,10 @@ { "@timestamp": "2018-10-17T12:58:47.550-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -917,8 +1047,10 @@ { "@timestamp": "2018-10-17T12:58:47.556-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -931,8 +1063,10 @@ { "@timestamp": "2018-10-17T12:58:47.556-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -945,8 +1079,10 @@ { "@timestamp": "2018-10-17T12:58:47.558-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -959,8 +1095,10 @@ { "@timestamp": "2018-10-17T12:58:47.558-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -973,8 +1111,10 @@ { "@timestamp": "2018-10-17T12:58:47.561-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -987,8 +1127,10 @@ { "@timestamp": "2018-10-17T12:58:47.561-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1001,8 +1143,10 @@ { "@timestamp": "2018-10-17T12:58:47.567-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1015,8 +1159,10 @@ { "@timestamp": "2018-10-17T12:58:47.567-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1029,8 +1175,10 @@ { "@timestamp": "2018-10-17T12:58:47.568-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1043,8 +1191,10 @@ { "@timestamp": "2018-10-17T12:58:47.568-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1057,8 +1207,10 @@ { "@timestamp": "2018-10-17T12:58:47.568-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -1071,8 +1223,10 @@ { "@timestamp": "2018-10-17T12:58:47.577-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.kafka.clients.FetchSessionHandler", @@ -1085,8 +1239,10 @@ { "@timestamp": "2018-10-17T12:58:47.577-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -1099,8 +1255,10 @@ { "@timestamp": "2018-10-17T12:58:47.583-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -1113,8 +1271,10 @@ { "@timestamp": "2018-10-17T12:58:47.585-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1127,8 +1287,10 @@ { "@timestamp": "2018-10-17T12:58:47.586-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1141,8 +1303,10 @@ { "@timestamp": "2018-10-17T12:58:47.594-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -1155,8 +1319,10 @@ { "@timestamp": "2018-10-17T12:58:47.601-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.kafka.clients.FetchSessionHandler", @@ -1169,8 +1335,10 @@ { "@timestamp": "2018-10-17T12:58:47.602-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -1183,8 +1351,10 @@ { "@timestamp": "2018-10-17T12:58:47.602-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherThread", @@ -1197,8 +1367,10 @@ { "@timestamp": "2018-10-17T12:58:47.604-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.KafkaServer", @@ -1211,8 +1383,10 @@ { "@timestamp": "2018-10-17T12:58:47.605-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.common.ZkNodeChangeNotificationListener$ChangeEventProcessThread", @@ -1225,8 +1399,10 @@ { "@timestamp": "2018-10-17T12:58:47.606-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.common.ZkNodeChangeNotificationListener$ChangeEventProcessThread", @@ -1239,8 +1415,10 @@ { "@timestamp": "2018-10-17T12:58:47.606-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1253,8 +1431,10 @@ { "@timestamp": "2018-10-17T12:58:47.606-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1267,8 +1447,10 @@ { "@timestamp": "2018-10-17T12:58:47.606-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.common.ZkNodeChangeNotificationListener$ChangeEventProcessThread", @@ -1281,8 +1463,10 @@ { "@timestamp": "2018-10-17T12:58:47.607-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.network.SocketServer", @@ -1295,8 +1479,10 @@ { "@timestamp": "2018-10-17T12:58:47.608-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1309,8 +1495,10 @@ { "@timestamp": "2018-10-17T12:58:47.608-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1323,8 +1511,10 @@ { "@timestamp": "2018-10-17T12:58:47.609-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1337,8 +1527,10 @@ { "@timestamp": "2018-10-17T12:58:47.609-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1351,8 +1543,10 @@ { "@timestamp": "2018-10-17T12:58:47.610-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1365,8 +1559,10 @@ { "@timestamp": "2018-10-17T12:58:47.610-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", @@ -1379,8 +1575,10 @@ { "@timestamp": "2018-10-17T12:58:47.611-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaFetcherManager", @@ -1393,8 +1591,10 @@ { "@timestamp": "2018-10-17T12:58:47.611-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ReplicaAlterLogDirsManager", diff --git a/filebeat/module/kafka/log/test/server.log-expected.json b/filebeat/module/kafka/log/test/server.log-expected.json index f92b26d249a..82e2fdb8779 100644 --- a/filebeat/module/kafka/log/test/server.log-expected.json +++ b/filebeat/module/kafka/log/test/server.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2017-08-04T10:48:20.377-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.KafkaServer", @@ -16,8 +18,10 @@ { "@timestamp": "2017-08-04T10:48:20.379-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.KafkaServer", @@ -30,8 +34,10 @@ { "@timestamp": "2017-08-04T10:48:20.400-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.zookeeper.ZooKeeper", @@ -44,8 +50,10 @@ { "@timestamp": "2017-08-04T10:48:20.400-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.zookeeper.ZooKeeper", @@ -58,8 +66,10 @@ { "@timestamp": "2017-08-04T10:48:20.401-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.zookeeper.ZooKeeper", @@ -72,8 +82,10 @@ { "@timestamp": "2017-08-04T10:48:20.413-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.I0Itec.zkclient.ZkClient", @@ -86,8 +98,10 @@ { "@timestamp": "2017-08-04T10:48:20.415-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.zookeeper.ClientCnxn", @@ -100,8 +114,10 @@ { "@timestamp": "2017-08-04T10:48:20.420-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.zookeeper.ClientCnxn", @@ -114,8 +130,10 @@ { "@timestamp": "2017-08-04T10:48:20.457-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.apache.zookeeper.ClientCnxn", @@ -128,8 +146,10 @@ { "@timestamp": "2017-08-04T10:48:20.458-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "org.I0Itec.zkclient.ZkClient", @@ -142,8 +162,10 @@ { "@timestamp": "2017-08-04T10:48:20.748-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.BrokerMetadataCheckpoint", @@ -156,8 +178,10 @@ { "@timestamp": "2017-08-04T10:48:20.800-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.ClientQuotaManager$ThrottledRequestReaper", @@ -170,8 +194,10 @@ { "@timestamp": "2017-08-04T10:48:20.866-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.LogManager", @@ -184,8 +210,10 @@ { "@timestamp": "2017-08-04T10:48:20.873-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.log.LogManager", @@ -198,8 +226,10 @@ { "@timestamp": "2017-08-04T10:48:21.062-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.server.DelayedOperationPurgatory$ExpiredOperationReaper", @@ -212,8 +242,10 @@ { "@timestamp": "2017-08-04T10:48:21.063-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.utils.ZKCheckedEphemeral", @@ -226,8 +258,10 @@ { "@timestamp": "2017-08-04T10:48:21.095-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.group.GroupMetadataManager", @@ -240,8 +274,10 @@ { "@timestamp": "2017-08-04T10:48:21.127-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.transaction.ProducerIdManager", @@ -254,8 +290,10 @@ { "@timestamp": "2017-08-04T10:48:21.162-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.transaction.TransactionCoordinator", @@ -268,8 +306,10 @@ { "@timestamp": "2017-08-04T10:48:21.167-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "kafka.coordinator.transaction.TransactionMarkerChannelManager", diff --git a/filebeat/module/kafka/log/test/state-change-1.1.0.log-expected.json b/filebeat/module/kafka/log/test/state-change-1.1.0.log-expected.json index e8c9e5d047d..c7e7d804d25 100644 --- a/filebeat/module/kafka/log/test/state-change-1.1.0.log-expected.json +++ b/filebeat/module/kafka/log/test/state-change-1.1.0.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2018-07-16T10:17:06.489-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "state.change.logger", diff --git a/filebeat/module/kafka/log/test/state-change-2.0.0.log-expected.json b/filebeat/module/kafka/log/test/state-change-2.0.0.log-expected.json index db2c5e919e7..7edb0c4d274 100644 --- a/filebeat/module/kafka/log/test/state-change-2.0.0.log-expected.json +++ b/filebeat/module/kafka/log/test/state-change-2.0.0.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2018-10-31T15:09:30.451-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "state.change.logger", diff --git a/filebeat/module/kafka/log/test/state-change.log-expected.json b/filebeat/module/kafka/log/test/state-change.log-expected.json index 76a5b7a8afe..eea369d05a2 100644 --- a/filebeat/module/kafka/log/test/state-change.log-expected.json +++ b/filebeat/module/kafka/log/test/state-change.log-expected.json @@ -2,8 +2,10 @@ { "@timestamp": "2017-08-04T10:48:21.428-02:00", "event.dataset": "kafka.log", + "event.kind": "event", "event.module": "kafka", "event.timezone": "-02:00", + "event.type": "info", "fileset.name": "log", "input.type": "log", "kafka.log.class": "state.change.logger",