I have a puppet server 5.3 which logs to logstash.
Daily I get ~90k messages, 95% of which are with log level INFO. I would like to get only the WARN and ERROR level but regardless what I try, I still get the INFOs. This is how I send the data to logstash via logback.xml:
<!-- This is the logstash part -->
<appender name="stash" class="net.logstash.logback.appender.LogstashSocketAppender">
<host>logserverhostname.com</host>
<port>514</port>
<level>WARN</level>
</appender>
<!-- End of the logstash part -->
<root level="WARN">
<appender-ref ref="stash" />
</root>
This is what I get when I check Kibana:
message:{"@timestamp":"2019-03-26T12:54:13.493+01:00","@version":1,"message":"Puppet 'replace_facts' command for somehost.com submitted to PuppetDB with UUID 92ba53a7-83f2-4438-b1da-f39cd7ccc844","logger_name":"puppetserver","thread_name":"qtp1518931796-63","level":"INFO","level_value":20000,"HOSTNAME":"puppet-server.com"} severity_label:Emergency severity:0 tags:syslog, _grokparsefailure_sysloginput @timestamp:March 26th 2019, 12:54:13.492 priority:0 @version:1 facility_label:kernel host:IP.IP.IP.IP facility:0 _id:v6PZuWkBButu0N-H0QkS _type:doc _index:syslog-2019.03.26 _score: -
I can filter out the result in Kibana, but I would prefer that I do not feed it with useless messages, thus saving IO, network traffic and disk space.
