Updating logstash filters

Sadly, there is no programmatic access to Logit’s logstash filters.

For new logit stacks…

If the logit stack is not a v6.x logstash (e.g. it’s a v5.6 like the current PaaS stacks are) the new filters need a plugin installed into logstash. You need to request this via logit support (either through the web-based “chat” logit have once you’ve logged in or via their email address). The plugin is for a filter called alter. v6.x logstash logit stacks have this plugin installed by default. Such a request might look like:

Please could you install the “alter” filter plugin into logstash for the stack with id e3352477-f40c-41c5-be46-5c52c0e3de38?

Process for generating logstash filters for Logit

We have instead come up with the following method.

Create your branch on PaaS-CF.
Make your changes and commit them as usual.
Two “upstream” repositories are used to generate the filter configuration. The required tags within each repository are specified in the Makefile (see the logit-filters target) - update them if required.
Run make logit-filters from the paas-cf directory (requires docker). This updates the config/logit/output/generated_logit_filters.conf file with the latest filter configuraton.
Check the diff for any potential gotchas.
Log into logit via Google[external link].
From the dashboard view, select the Settings button for the stack you wish to modify.
Select Logstash Filters and wait for the current page to load.
Select all of the existing filters and delete them.
Paste in your new filters and select Validate.
If the validation passes an Apply button will appear. Select this button.
Wait for application of the filters to finish.

Updating the components of the logstash filters

This information can be found in the readme