(Tune this limit based on your observed rate of traffic flow through the Destination.)įix: In LogStream 3.0.0. Also, reduce the Max file open time (sec) limit from its default 300 (5 minutes) to a shorter interval, to prevent files from growing to the 5 MB threshold. Workaround: Set the Max file size (MB) to 5 MB. This happens with files larger than 5 MB, and causes the Google Cloud API to report a vague Invalid argument error. Problem: The Google Cloud Storage Destination might fail to put objects into GCS buckets. – v.2.4.2–2.4.5 – Google Cloud Storage Destination fails to upload files > 5 MB Workaround: Programmatically or manually delete stale staging directories (e.g., those older than 30 days).įix: In LogStream 3.0.2. This is because LogStream cleans up staged files, but not staging directories. Problem: Using the S3 Destination, defining a partitioning expression with high cardinality can proliferate a large number (up to millions) of empty directories. – v.2.4.3–2.4.5 – Orphaned S3 staging directories Workaround: Reset the Rule's Default timezone to UTC, then click OK and resave the Ruleset.įix: In LogStream 3.0.2. This setting causes LogStream to discover events but not collect them. Problem: The Event Breaker Rule provided for the Office 365 Message Trace Source mistakenly presets the Default timezone to ETC/GMT‑0. – 2.4.5 – Office 365 Message Trace Source skips events Workaround: Explicitly set the Elastic version to either 7.x or 6.x (depending on your Elasticsearch cluster's version) then stop and restart LogStream to pick up this configuration change.
Elasticsearch responds with an HTTP 401 error.
Problem: When the Elasticsearch Destination has Basic Authentication enabled, and its Elastic version field specifies Auto version discovery, LogStream fails to send the configured username and password credentials along with its API initial request. For example: channel.startsWith('input:in_syslog:').įix: Planned for LogStream 3.4.0 – 2.4.5 – Elasticsearch Destination, with Auto version discovery, doesn't send Authorization header Workaround: Replace this default filter expression with channel.startsWith('input:').
Problem: In the Syslog and Metrics Sources's Logs tab, the auto-generated filter expression ( channel ='input:in_syslog') is not specific enough and yields no results, because it doesn't address these Sources' two channels ( input:in_syslog:tcp and input:in_syslog:udp). Known Issues – All versions through 3.x – Syslog and Metrics Sources' default filter expression needs correction
0 kommentar(er)
