I'm actually already doing this in the logstash labs instance for #-labs messages. One of the challenges in prod is that we wouldn't want all 3 logstash nodes to attach to the channel at the same time. We'd get duplicate messages and nick conflicts.
Version: wmf-deployment
Severity: enhancement
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=44791
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | Feature | None | T46791 [[wikitech:Server_admin_log]] should not rely on IRC for logmsgbot entries | ||
| Open | Feature | None | T63779 Add system logs to logstash (tracking) | ||
| Resolved | bd808 | T63544 Add !log entries from #-operations to logstash |
Also, you don't want duplicate entries from eg scap logging directly to logstash then also via the !log output in -operations. Thought of as I reported bug 62177 (localisation updates in logstash).
I have a pet project running in Labs that addresses this: https://stashbot.wmflabs.org/#/dashboard/elasticsearch/SAL. It won't make the !log messages visible in the same Kibana interface as normal Logstash traffic but it does get them all into an Elasticsearch index.
I have a tool up that gives a little nicer interface for classic SAL browsing behavior: https://tools.wmflabs.org/sal/