[15:52:06] <inflatador_>	 Heya 0lly, do y'all have any advice on the best way to get opensearch logs into logstash? Our logging pipeline broke when we migrated from elastic->OpenSearch . Just wondering if y'all had something set up already. Ref T395571
[15:52:06] <stashbot>	 T395571: Verify/fix Logstash pipeline/log rotate  for Search Platform-owned OpenSearch clusters - https://phabricator.wikimedia.org/T395571
[16:41:55] <cwhite>	 inflatador_: There are a few ways, but the most common way these days is to write JSON logs to a file and use rsyslog::input::file to forward them on.
[16:44:09] <cwhite>	 https://wikitech.wikimedia.org/wiki/Logstash/Interface
[17:07:23] <inflatador_>	 cwhite ACK, thanks for the tip! Will take a look
[20:34:48] <jinxer-wm>	 FIRING: PuppetFailure: Puppet has failed on logging-hd2005:9100 - https://puppetboard.wikimedia.org/nodes?status=failed - https://grafana.wikimedia.org/d/yOxVDGvWk/puppet - https://alerts.wikimedia.org/?q=alertname%3DPuppetFailure
[21:37:31] <inflatador_>	 cwhite following up on the earlier stuff, I've got a patch up to fix the cirrussearch logstash stuff. It affects observability hosts (although really it just adds a comment to the jvm.options file), so I wanted to me sure y'all had a chance to review: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1178613
[21:44:48] <jinxer-wm>	 RESOLVED: PuppetFailure: Puppet has failed on logging-hd2005:9100 - https://puppetboard.wikimedia.org/nodes?status=failed - https://grafana.wikimedia.org/d/yOxVDGvWk/puppet - https://alerts.wikimedia.org/?q=alertname%3DPuppetFailure
[22:05:06] <cwhite>	 inflatador_: thanks!  I have some questions, but otherwise looking good :)