On Fri, Jun 2, 2017 at 8:01 PM, Oleksandr Gavenko <gavenkoa@gmail.com> wrote:
Alternative approach is to write log and later parse it. Like this done with Filebeat https://www.elastic.co/products/beats/filebeat that complement to ElasticSearch.
The problem with such solution is necessity to invent or follow file format. Formatting log with MDC and Markers that can be tricky.
What I forgot to add is that parsing stack traces with filebeat is not a pleasure. Also it's tricky to manage file rotation, from https://discuss.elastic.co/t/will-filebeat-handle-properly-the-underlying-lo...
while filebeat uses file metadata like inode and device id in order to track files, it still requires the full path in order to open files. The prospectors can only find files by path and do check inode/device id against known set of inodes.
If a file is simply renamed or closed by the logger, but still open by filebeat, filebeat will process until end (will not close file handle yet). But if filebeat gets restarted in between, it needs to find the renamed files again. In order to find renamed files, the glob pattern must match rotated files too. So to say, it's better use pattern mysqld.log*.
That is not reliable solution in my view.