Troubleshooting for LogMan.io Parsec¶

Timezone¶

CRITICAL lmio-parsec.app Missing 'zookeeper' section in configuration.

Add the [zookeeper] section in configuration:

lmio-parsec.conf

[zookeeper]
servers=zookeeper-1:2181,zookeeper-2:2181,zookeeper-3:2181

CRITICAL lmioparsec.app Missing configuration option '[tenant] name'.

Add tenant name to the configuration:

lmio-parsec.conf

[tenant]
name=my-tenant

CRITICAL lmioparsec.app Configuration option '[eventlane] name' must start with '/EventLanes/'.

Modify event lane name so it starts with /EventLanes:

lmio-parsec.conf

[eventlane]
name=/EventLanes/<tenant>/<eventlane>.yaml

CRITICAL lmioparsec.app Configuration option '[parser] name' must start with '/Parsers/'.

Make sure that path for parsing rules starts with /Parsers.

/EventLanes/tenant/eventlane.yaml

define:
    type: lmio/event-lane

parsec:
    name: /Parsers/path/to/parsers

CRITICAL lmioparsec.app Cannot find file '/EventLanes/tenant/eventlane.yaml' in Library, exiting.

Make sure that the file /EventLanes/tenant/eventlane.yaml exists and its enabled for given tenant.

CRITICAL lmioparsec.app Cannot read '/EventLanes/tenant/eventlane.yaml' declaration: <error description>, exiting.

There is a syntax error in /EventLanes/tenant/eventlane.yaml file. Try to correct it inspired by the error description.

ERROR: lmioparsec.declaration_loader Cannot construct pipeline: no declarations found.

Make sure you have configured the proper path for parsing rules in event lane file.

WARNING lmioparsec.declaration_loader Missing 'schema' section in /Parsers/Linux/Common/50_enricher.yaml

Every enricher rule that stands behind mapping should contain schema in define section:

/Parsers/Linux/Common/50_enricher.yaml

define:
    type: parser/enricher
    schema: /Schemas/ECS.yaml