{"host": "db1300.eqiad.wmnet", "state": "core_diff", "description": "Differences to core resources", "diff": {"full": {"total": 2620, "only_in_self": [], "only_in_other": [], "resource_diffs": [{"resource": "File[/etc/rsyslog.d/30-output-kafka.conf]", "content": "--- /etc/rsyslog.d/30-output-kafka.conf.orig\n+++ /etc/rsyslog.d/30-output-kafka.conf\n@@ -58,7 +58,10 @@\n         # Event Platform events carry a 'meta.stream' field. Produce these only to\n         # the '<datacenter>.<meta.stream>' topic (T291645). Logstash consumes this\n         # topic via an explicit kafka input rather than the 'rsyslog-*' pattern.\n+        # We also need to unset the $!msg field here, which is left over from the\n+        # failed mmjsonparse_kafka_raw parsing attempt.\n         if ($!meta!stream != \"\") then {\n+            unset $!msg;\n             action(type=\"omkafka\"\n                    name=\"omkafka_event_platform\"\n                    broker=[\"kafka-logging1001.eqiad.wmnet:9093\",\"kafka-logging1002.eqiad.wmnet:9093\",\"kafka-logging1003.eqiad.wmnet:9093\",\"kafka-logging1004.eqiad.wmnet:9093\",\"kafka-logging1005.eqiad.wmnet:9093\"]"}, {"resource": "Rsyslog::Conf[output_kafka]"}], "perc_changed": "0.08%"}, "core": {"total": 2620, "only_in_self": [], "only_in_other": [], "resource_diffs": [{"resource": "File[/etc/rsyslog.d/30-output-kafka.conf]", "content": "--- /etc/rsyslog.d/30-output-kafka.conf.orig\n+++ /etc/rsyslog.d/30-output-kafka.conf\n@@ -58,7 +58,10 @@\n         # Event Platform events carry a 'meta.stream' field. Produce these only to\n         # the '<datacenter>.<meta.stream>' topic (T291645). Logstash consumes this\n         # topic via an explicit kafka input rather than the 'rsyslog-*' pattern.\n+        # We also need to unset the $!msg field here, which is left over from the\n+        # failed mmjsonparse_kafka_raw parsing attempt.\n         if ($!meta!stream != \"\") then {\n+            unset $!msg;\n             action(type=\"omkafka\"\n                    name=\"omkafka_event_platform\"\n                    broker=[\"kafka-logging1001.eqiad.wmnet:9093\",\"kafka-logging1002.eqiad.wmnet:9093\",\"kafka-logging1003.eqiad.wmnet:9093\",\"kafka-logging1004.eqiad.wmnet:9093\",\"kafka-logging1005.eqiad.wmnet:9093\"]"}], "perc_changed": "0.04%"}, "main": {"total": 2620, "only_in_self": [], "only_in_other": [], "resource_diffs": [{"resource": "File[/etc/rsyslog.d/30-output-kafka.conf]", "content": "--- /etc/rsyslog.d/30-output-kafka.conf.orig\n+++ /etc/rsyslog.d/30-output-kafka.conf\n@@ -58,7 +58,10 @@\n         # Event Platform events carry a 'meta.stream' field. Produce these only to\n         # the '<datacenter>.<meta.stream>' topic (T291645). Logstash consumes this\n         # topic via an explicit kafka input rather than the 'rsyslog-*' pattern.\n+        # We also need to unset the $!msg field here, which is left over from the\n+        # failed mmjsonparse_kafka_raw parsing attempt.\n         if ($!meta!stream != \"\") then {\n+            unset $!msg;\n             action(type=\"omkafka\"\n                    name=\"omkafka_event_platform\"\n                    broker=[\"kafka-logging1001.eqiad.wmnet:9093\",\"kafka-logging1002.eqiad.wmnet:9093\",\"kafka-logging1003.eqiad.wmnet:9093\",\"kafka-logging1004.eqiad.wmnet:9093\",\"kafka-logging1005.eqiad.wmnet:9093\"]"}, {"resource": "Rsyslog::Conf[output_kafka]"}], "perc_changed": "0.08%"}}}