[19:43:47] <andrewbogott>	 Anyone have a few minutes to help me understand an rsyslogd thing
[19:43:49] <andrewbogott>	 ?
[19:44:18] <andrewbogott>	 i'm pretty sure that I have things set up properly but I can't get kibana to display anything from the service (which is haproxy on e.g. cloudcontrol2005-dev.wikimedia.org)
[20:12:37] <cwhite>	 andrewbogott: I see some haproxy logs in the last four hours `program:haproxy AND host:cloudcontrol2005*` in `logstash-*` indexes.
[20:37:41] <andrewbogott>	 oops, got distracted.  cwhite, that means that my problem is just having the wrong filter on kibana probably :)
[20:38:09] <andrewbogott>	 let's see if I can figure out how to share... https://logstash.wikimedia.org/app/dashboards#/view/8aa679f0-d52e-11eb-81e9-e1226573bad4?_g=(filters%3A!()%2CrefreshInterval%3A(pause%3A!t%2Cvalue%3A0)%2Ctime%3A(from%3Anow-12h%2Cto%3Anow))
[20:52:10] <cwhite>	 I see.  That dashboard is ECS and haproxy logs are legacy schema.
[20:55:34] <andrewbogott>	 oh, and that dash just throws away anything that's not ECS? I was expecting to see records, just mangled ones :)
[21:02:57] <cwhite>	 Yeah, the two schemas are incompatible.  It'd be TypeError city!
[21:13:19] <andrewbogott>	 ok then :)  I'll just make another dash for haproxy.  thanks
[21:13:38] <andrewbogott>	 s/make/find/ apparently I already did all this
[21:19:52] <andrewbogott>	 thanks cwhite
[21:39:07] <cwhite>	 I'll have a look into what it would take to reformat haproxy logs into ECS.  If they're simple enough then I'll just convert them and let you know.