logsearch/logsearch-boshrelease — pull request #80 by dpb587 (2014-10-27 23:51:28+00:00)
Title: Add archive restoration capabilities

This PR adds the scripts for restoring data from one or more archives. The `examples/bosh-lite.yml` includes an example job, `restorer`, which is pre-configured to both ingest and parse restored messages. If you need rapid restoration, you'll probably want to start additional instances. Note that in most cases, you will want to use a separate restoration queue in redis (otherwise you'll end up double-archiving these restored events).

The following commands are also included in the `examples/bosh-lite.yml` above the `restorer` job:

# pipe our local file to a remote tmp file, sudo, pipe that tmp file into the command, delete our tmp file; kind of convoluted
$ cat 2014102715.20141027150019-api-0.log.xz | ssh -i "$HOME/.ssh/vagrant" vcap@10.244.2.26 "cat > /tmp/ssh-$$ && echo c1oudc0w | sudo -p '' -S -- /bin/bash -c 'cat /tmp/ssh-$$ | /var/vcap/jobs/ingestor_archiver/bin/reload xz' && rm /tmp/ssh-$$"
Stopping logstash...done
Purging existing logs, state...done
Transferring logs...done
Extracting logs....done
Starting logstash...............done

# run the utility script which blocks until we've read all the waiting log files
$ ssh -i "$HOME/.ssh/vagrant" vcap@10.244.2.26 "echo c1oudc0w | sudo -p '' -S -- /var/vcap/jobs/ingestor_archiver/bin/wait-until-loaded"
/var/vcap/data/archiver-restorer/restore/_reload: 1623006 of 923651191
/var/vcap/data/archiver-restorer/restore/_reload: 16394000 of 923651191
/var/vcap/data/archiver-restorer/restore/_reload: 36017618 of 923651191
/var/vcap/data/archiver-restorer/restore/_reload: 47640964 of 923651191
/var/vcap/data/archiver-restorer/restore/_reload: 61461106 of 923651191
/var/vcap/data/archiver-restorer/restore/_reload: 78232168 of 923651191
/var/vcap/data/archiver-restorer/restore/_reload: 102429712 of 923651191
...snip...
/var/vcap/data/archiver-restorer/restore/_reload: 919588642 of 923651191

$ echo $?
0