lusis/chef-logstash — pull request #265 by canadianveggie (2014-04-14 22:36:53+00:00)
Title: Fix to handle nested hashes in logstash.conf

The old logstash_conf.rb library wasn't properly matching braces when formatting nested hashes. Specifically it was closing braces without opening them. Here's an example to illustrate:

Chef config:
node.default[:logstash][:server][:filters] = [
{
:condition => 'if "nginx_error" in [type]',
:block => {
:grok => {
:match => {
:message => ['%{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:error_message}']
},
:add_field => {
"application_tag" => "nginx"
} } } } }

old logstash.conf snippet:
if "nginx_error" in [type] {
grok {
'patterns_dir' => "/opt/logstash/server/etc/patterns"
'add_field' => 'application_tag' => "nginx"
}
'match' => 'message' => ["%{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:error_message}"]

}
}
}

new logstash.conf snippet with this change (the braces are fixed and so is the indentation):
if "nginx_error" in [type] {
grok {
'patterns_dir' => "/opt/logstash/server/etc/patterns"
'add_field' => {
'application_tag' => "nginx"
}
'match' => {
'message' => ["%{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:error_message}"]
}
}
}