cockroachlabs-field / log-analyzer Goto Github PK

should contain the following:

• count of interesting log events
• count of total events
• count of nodes/sources

cockroach.roach-0.root.2019-01-11T21_24_53Z.000001.log

Lets grab node and timestamp from .log name

probably something like https://answers.splunk.com/answers/187004/how-to-whitelist-or-blacklist-log-files-in-zip-arc.html

By using the latest splunk image it's pulling down a Redhat image causing the apt-get run commands to fail when building. Instead, switch the dockerfile to use the 7.3.4 tag to get the debian based version. BTW - Fantastic image. Works like a charm otherwise.

When I run this on a debug.zip, the Splunk docker build fails with:

...
...
Step 4/16 : ADD *.zip /tmp/crdb
 ---> d973dddcc852
Step 5/16 : RUN unzip -q /tmp/crdb/*.zip -d /tmp/crdb
 ---> Running in c64e6cfcb62b
replace /tmp/crdb/debug/liveness.json? [y]es, [n]o, [A]ll, [N]one, [r]ename:  NULL
(EOF or read error, treating as "[N]one" ...)
ERROR: Service 'splunk' failed to build: The command '/bin/sh -c unzip -q /tmp/crdb/*.zip -d /tmp/crdb' returned a non-zero code: 1

Adding -o to the unzip command solves this problem.
https://github.com/timveil-cockroach/log-analyzer/blob/fd7b36a1ac51bd5806631200c9df0bac12809acc/splunk/Dockerfile#L12

New line:

RUN unzip -qo /tmp/crdb/*.zip -d /tmp/crdb && \