AMBARI-18606. Improve Audit Log processing by Logfeeder (Miklos Gergely via oleewere)

Change-Id: I9e357536115a691801013932cf13051908170d93

ambari-logsearch/ambari-logsearch-logfeeder/src/main/java/org/apache/ambari/logfeeder/filter/FilterKeyValue.java

@@ -19,6 +19,7 @@
 
 package org.apache.ambari.logfeeder.filter;
 
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.regex.Pattern;
@@ -68,18 +69,26 @@ public class FilterKeyValue extends Filter {
     if (sourceField == null) {
       return;
     }
-    Object valueObj = jsonObj.get(sourceField);
-    if (valueObj != null) {
+    if (jsonObj.containsKey(sourceField)) {
+      String keyValueString = (String) jsonObj.get(sourceField);
+      Map<String, String> valueMap = new HashMap<>();
+      if (valueBorders != null) {
+        keyValueString = preProcessBorders(keyValueString, valueMap);
+      }
+      
       String splitPattern = Pattern.quote(fieldSplit);
-      String[] tokens = valueObj.toString().split(splitPattern);
+      String[] tokens = keyValueString.split(splitPattern);
       for (String nv : tokens) {
         String[] nameValue = getNameValue(nv);
         String name = nameValue != null && nameValue.length == 2 ? nameValue[0] : null;
         String value = nameValue != null && nameValue.length == 2 ? nameValue[1] : null;
         if (name != null && value != null) {
-            jsonObj.put(name, value);
-         } else {
-           logParseError("name=" + name + ", pair=" + nv + ", field=" + sourceField + ", field_value=" + valueObj);
+          if (valueMap.containsKey(value)) {
+            value = valueMap.get(value);
+          }
+          jsonObj.put(name, value);
+        } else {
+         logParseError("name=" + name + ", pair=" + nv + ", field=" + sourceField + ", field_value=" + keyValueString);
         }
       }
     }
@@ -87,19 +96,41 @@ public class FilterKeyValue extends Filter {
     statMetric.value++;
   }
 
-  private String[] getNameValue(String nv) {
-    if (valueBorders != null) {
-      if (nv.charAt(nv.length() - 1) == valueBorders.charAt(1)) {
-        String splitPattern = Pattern.quote("" + valueBorders.charAt(0));
-        return nv.substring(0, nv.length() - 1).split(splitPattern);
-      } else {
-        return null;
+  private String preProcessBorders(String keyValueString, Map<String, String> valueMap) {
+    char openBorder = valueBorders.charAt(0);
+    char closeBorder = valueBorders.charAt(1);
+    
+    StringBuilder processed = new StringBuilder();
+    int lastPos = 0;
+    int openBorderNum = 0;
+    int valueNum = 0;
+    for (int pos = 0; pos < keyValueString.length(); pos++) {
+      char c = keyValueString.charAt(pos);
+      if (c == openBorder) {
+        if (openBorderNum == 0 ) {
+          processed.append(keyValueString.substring(lastPos, pos));
+          lastPos = pos + 1;
+        }
+        openBorderNum++;
+      }
+      if (c == closeBorder) {
+        openBorderNum--;
+        if (openBorderNum == 0) {
+          String value = keyValueString.substring(lastPos, pos).trim();
+          String valueId = "$VALUE" + (++valueNum);
+          valueMap.put(valueId, value);
+          processed.append(valueSplit + valueId);
+          lastPos = pos + 1;
+        }
       }
     }
-    else {
-      String splitPattern = Pattern.quote(valueSplit);
-      return nv.split(splitPattern);
-    }
+    
+    return processed.toString();
+  }
+
+  private String[] getNameValue(String nv) {
+    String splitPattern = Pattern.quote(valueSplit);
+    return nv.split(splitPattern);
   }
 
   private void logParseError(String inputStr) {

ambari-logsearch/ambari-logsearch-logfeeder/src/main/java/org/apache/ambari/logfeeder/mapper/MapperFieldCopy.java

@@ -0,0 +1,58 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * 
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.ambari.logfeeder.mapper;
+
+import java.util.Map;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.log4j.Logger;
+
+/**
+ * Overrides the value for the field
+ */
+public class MapperFieldCopy extends Mapper {
+  private static final Logger LOG = Logger.getLogger(MapperFieldCopy.class);
+  
+  private String copyName = null;
+
+  @Override
+  public boolean init(String inputDesc, String fieldName, String mapClassCode, Object mapConfigs) {
+    init(inputDesc, fieldName, mapClassCode);
+    if (!(mapConfigs instanceof Map)) {
+      LOG.fatal("Can't initialize object. mapConfigs class is not of type Map. " + mapConfigs.getClass().getName());
+      return false;
+    }
+    
+    @SuppressWarnings("unchecked")
+    Map<String, Object> mapObjects = (Map<String, Object>) mapConfigs;
+    copyName = (String) mapObjects.get("copy_name");
+    if (StringUtils.isEmpty(copyName)) {
+      LOG.fatal("Map copy name is empty.");
+      return false;
+    }
+    return true;
+  }
+
+  @Override
+  public Object apply(Map<String, Object> jsonObj, Object value) {
+    jsonObj.put(copyName, value);
+    return value;
+  }
+}

ambari-logsearch/ambari-logsearch-logfeeder/src/main/resources/alias_config.json

@@ -25,6 +25,9 @@
     "map_date": {
       "klass": "org.apache.ambari.logfeeder.mapper.MapperDate"
     },
+    "map_fieldcopy": {
+      "klass": "org.apache.ambari.logfeeder.mapper.MapperFieldCopy"
+    },
     "map_fieldname": {
       "klass": "org.apache.ambari.logfeeder.mapper.MapperFieldName"
     },

ambari-logsearch/ambari-logsearch-logfeeder/src/test/java/org/apache/ambari/logfeeder/mapper/MapperFieldCopyTest.java

@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.ambari.logfeeder.mapper;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.log4j.Logger;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class MapperFieldCopyTest {
+  private static final Logger LOG = Logger.getLogger(MapperFieldCopyTest.class);
+
+  @Test
+  public void testMapperFieldCopy_copyField() {
+    LOG.info("testMapperFieldCopy_copyField()");
+
+    Map<String, Object> mapConfigs = new HashMap<>();
+    mapConfigs.put("copy_name", "someOtherField");
+
+    MapperFieldCopy mapperFieldCopy = new MapperFieldCopy();
+    assertTrue("Could not initialize!", mapperFieldCopy.init(null, "someField", null, mapConfigs));
+
+    Map<String, Object> jsonObj = new HashMap<>();
+    jsonObj.put("someField", "someValue");
+
+    mapperFieldCopy.apply(jsonObj, "someValue");
+
+    assertEquals("Old field name wasn't removed", "someValue", jsonObj.remove("someField"));
+    assertEquals("New field wasn't put", "someValue", jsonObj.remove("someOtherField"));
+    assertTrue("jsonObj is not empty", jsonObj.isEmpty());
+  }
+
+  @Test
+  public void testMapperFielCopy_configNotMap() {
+    LOG.info("testMapperFieldCopy_configNotMap()");
+
+    MapperFieldCopy mapperFieldCopy = new MapperFieldCopy();
+    assertFalse("Was able to initialize!", mapperFieldCopy.init(null, "someField", null, ""));
+  }
+
+  @Test
+  public void testMapperFieldCopy_noNewFieldName() {
+    LOG.info("testMapperFieldCopy_noNewFieldName()");
+
+    Map<String, Object> mapConfigs = new HashMap<>();
+
+    MapperFieldCopy mapperFieldCopy = new MapperFieldCopy();
+    assertFalse("Was able to initialize!", mapperFieldCopy.init(null, "someField", null, mapConfigs));
+  }
+}

ambari-logsearch/ambari-logsearch-portal/src/main/configsets/audit_logs/conf/managed-schema

@@ -109,4 +109,9 @@
   <field name="message_md5" type="string" multiValued="false"/>
   <field name="type" type="key_lower_case" multiValued="false"/>
   
+  <dynamicField name='ngram_*' type="n_gram" multiValued="false" stored="true"/>
+  <dynamicField name='std_*' type="text_std_token_lower_case" multiValued="false" stored="true"/>
+  <dynamicField name='key_*' type="key_lower_case" multiValued="false" stored="true"/>
+  <dynamicField name="ws_*" type="text_ws" multiValued="false" omitNorms="false" stored="true"/>
+  
 </schema>

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/common/LogSearchConstants.java

@@ -41,7 +41,7 @@ public class LogSearchConstants {
   public static final String I_E_SEPRATOR = "\\|i\\:\\:e\\|";
 
   //SUFFIX
-  public static final String NGRAM_SUFFIX = "ngram_";
+  public static final String NGRAM_PREFIX = "ngram_";
 
   //Date Format for SOLR
   public static final String SOLR_DATE_FORMAT = "yyyy-MM-dd HH:mm:ss,SSS";

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/dao/AuditSolrDao.java

@@ -67,7 +67,7 @@ public class AuditSolrDao extends SolrDaoBase {
 
     try {
       solrCollectionDao.checkSolrStatus(getSolrClient());
-      boolean createAlias = (aliasNameIn != null && !StringUtils.isBlank(rangerAuditCollection));
+      boolean createAlias = (aliasNameIn != null && StringUtils.isNotBlank(rangerAuditCollection));
       solrCollectionDao.setupCollections(getSolrClient(), solrAuditLogPropsConfig);
       if (createAlias) {
         solrAliasDao.setupAlias(solrSchemaFieldDao, getSolrClient(), solrAuditLogPropsConfig);

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/dao/SolrCollectionDao.java

@@ -30,6 +30,7 @@ import org.apache.solr.common.cloud.Slice;
 import org.apache.solr.common.cloud.ZkStateReader;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import static org.apache.ambari.logsearch.solr.SolrConstants.CommonLogConstants.ROUTER_FIELD;
 
 import javax.inject.Named;
 import java.io.IOException;
@@ -43,7 +44,6 @@ public class SolrCollectionDao {
 
   private static final Logger LOG = LoggerFactory.getLogger(SolrCollectionDao.class);
 
-  private static final String ROUTER_FIELD = "_router_field_";
   private static final int SETUP_RETRY_SECOND = 30;
 
   /**

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/dao/SolrSchemaFieldDao.java

@@ -25,11 +25,13 @@ import org.apache.ambari.logsearch.conf.SolrUserPropsConfig;
 import org.apache.solr.client.solrj.SolrRequest;
 import org.apache.solr.client.solrj.SolrServerException;
 import org.apache.solr.client.solrj.impl.CloudSolrClient;
+import org.apache.solr.client.solrj.request.LukeRequest;
+import org.apache.solr.client.solrj.request.schema.FieldTypeDefinition;
 import org.apache.solr.client.solrj.request.schema.SchemaRequest;
+import org.apache.solr.client.solrj.response.LukeResponse;
+import org.apache.solr.client.solrj.response.LukeResponse.FieldInfo;
 import org.apache.solr.client.solrj.response.schema.SchemaResponse;
 import org.apache.solr.common.SolrException;
-import org.apache.solr.common.util.NamedList;
-import org.codehaus.jettison.json.JSONArray;
 import org.codehaus.jettison.json.JSONObject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -37,15 +39,17 @@ import org.slf4j.LoggerFactory;
 import javax.inject.Inject;
 import java.io.IOException;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
+import java.util.Map.Entry;
 
 public class SolrSchemaFieldDao {
 
   private static final Logger LOG = LoggerFactory.getLogger(SolrSchemaFieldDao.class);
 
   private static final int SETUP_RETRY_SECOND = 30;
-  private static final int SETUP_UPDATE_SECOND = 10 * 60; // 10 min
-
+  private static final int SETUP_UPDATE_SECOND = 1 * 60; // 1 min
+  
   private boolean populateFieldsThreadActive = false;
 
   private Map<String, String> schemaFieldNameMap = new HashMap<>();
@@ -93,73 +97,84 @@ public class SolrSchemaFieldDao {
    * Called from the thread. Don't call this directly
    */
   private boolean _populateSchemaFields(CloudSolrClient solrClient, SolrPropsConfig solrPropsConfig) {
-    SolrRequest<SchemaResponse> request = new SchemaRequest();
-    request.setMethod(SolrRequest.METHOD.GET);
-    request.setPath("/schema");
     String historyCollection = solrUserPropsConfig.getCollection();
     if (solrClient != null && !solrPropsConfig.getCollection().equals(historyCollection)) {
-      NamedList<Object> namedList = null;
+      LukeResponse lukeResponse = null;
+      SchemaResponse schemaResponse = null;
       try {
-        namedList = solrClient.request(request);
-        LOG.debug("populateSchemaFields() collection=" + solrPropsConfig.getCollection() + ", fields=" + namedList);
+        LukeRequest lukeRequest = new LukeRequest();
+        lukeRequest.setNumTerms(0);
+        lukeResponse = lukeRequest.process(solrClient);
+        
+        SolrRequest<SchemaResponse> schemaRequest = new SchemaRequest();
+        schemaRequest.setMethod(SolrRequest.METHOD.GET);
+        schemaRequest.setPath("/schema");
+        schemaResponse = schemaRequest.process(solrClient);
+        
+        LOG.debug("populateSchemaFields() collection=" + solrPropsConfig.getCollection() + ", luke=" + lukeResponse +
+            ", schema= " + schemaResponse);
       } catch (SolrException | SolrServerException | IOException e) {
         LOG.error("Error occured while popuplating field. collection=" + solrPropsConfig.getCollection(), e);
       }
 
-      if (namedList != null) {
-        extractSchemaFieldsName(namedList.toString(), schemaFieldNameMap, schemaFieldTypeMap);
+      if (lukeResponse != null && schemaResponse != null) {
+        extractSchemaFieldsName(lukeResponse, schemaResponse);
         return true;
       }
     }
     return false;
   }
 
-  public void extractSchemaFieldsName(String responseString,
-                                      final Map<String, String> schemaFieldsNameMap,
-                                      final Map<String, String> schemaFieldTypeMap) {
+  private void extractSchemaFieldsName(LukeResponse lukeResponse, SchemaResponse schemaResponse) {
     try {
-      JSONObject jsonObject = new JSONObject(responseString);
-      JSONObject schemajsonObject = jsonObject.getJSONObject("schema");
-      JSONArray jsonArrayList = schemajsonObject.getJSONArray("fields");
-      JSONArray fieldTypeJsonArray = schemajsonObject
-        .getJSONArray("fieldTypes");
-      if (jsonArrayList == null) {
-        return;
-      }
-      if (fieldTypeJsonArray == null) {
-        return;
-      }
+      HashMap<String, String> _schemaFieldNameMap = new HashMap<>();
       HashMap<String, String> _schemaFieldTypeMap = new HashMap<>();
-      HashMap<String, String> _schemaFieldsNameMap = new HashMap<String, String>();
-      for (int i = 0; i < fieldTypeJsonArray.length(); i++) {
-        JSONObject typeObject = fieldTypeJsonArray.getJSONObject(i);
-        String name = typeObject.getString("name");
-        String fieldTypeJson = typeObject.toString();
+      
+      for (Entry<String, FieldInfo> e : lukeResponse.getFieldInfo().entrySet()) {
+        String name = e.getKey();
+        String type = e.getValue().getType();
+        if (!name.contains("@") && !name.startsWith("_") && !name.contains("_md5") && !name.contains("_ms") &&
+          !name.contains(LogSearchConstants.NGRAM_PREFIX) && !name.contains("tags") && !name.contains("_str")) {
+          _schemaFieldNameMap.put(name, type);
+        }
+      }
+      
+      List<FieldTypeDefinition> fieldTypes = schemaResponse.getSchemaRepresentation().getFieldTypes();
+      for (FieldTypeDefinition fieldType : fieldTypes) {
+        Map<String, Object> fieldAttributes = fieldType.getAttributes();
+        String name = (String) fieldAttributes.get("name");
+        String fieldTypeJson = new JSONObject(fieldAttributes).toString();
         _schemaFieldTypeMap.put(name, fieldTypeJson);
       }
-      for (int i = 0; i < jsonArrayList.length(); i++) {
-        JSONObject explrObject = jsonArrayList.getJSONObject(i);
-        String name = explrObject.getString("name");
-        String type = explrObject.getString("type");
+      
+      List<Map<String, Object>> fields = schemaResponse.getSchemaRepresentation().getFields();
+      for (Map<String, Object> field : fields) {
+        String name = (String) field.get("name");
+        String type = (String) field.get("type");
         if (!name.contains("@") && !name.startsWith("_") && !name.contains("_md5") && !name.contains("_ms") &&
-          !name.contains(LogSearchConstants.NGRAM_SUFFIX) && !name.contains("tags") && !name.contains("_str")) {
-          _schemaFieldsNameMap.put(name, type);
+          !name.contains(LogSearchConstants.NGRAM_PREFIX) && !name.contains("tags") && !name.contains("_str")) {
+          _schemaFieldNameMap.put(name, type);
         }
       }
-      schemaFieldsNameMap.clear();
-      schemaFieldTypeMap.clear();
-      schemaFieldsNameMap.putAll(_schemaFieldsNameMap);
-      schemaFieldTypeMap.putAll(_schemaFieldTypeMap);
+      
+      if (_schemaFieldNameMap.isEmpty() || _schemaFieldTypeMap.isEmpty()) {
+        return;
+      }
+      
+      synchronized (this) {
+        schemaFieldNameMap = _schemaFieldNameMap;
+        schemaFieldTypeMap = _schemaFieldTypeMap;
+      }
     } catch (Exception e) {
       LOG.error(e + "Credentials not specified in logsearch.properties " + MessageEnums.ERROR_SYSTEM);
     }
   }
 
-  public Map<String, String> getSchemaFieldTypeMap() {
-    return schemaFieldTypeMap;
+  public synchronized Map<String, String> getSchemaFieldNameMap() {
+    return schemaFieldNameMap;
   }
 
-  public Map<String, String> getSchemaFieldNameMap() {
-    return schemaFieldNameMap;
+  public synchronized Map<String, String> getSchemaFieldTypeMap() {
+    return schemaFieldTypeMap;
   }
 }

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/dao/UserDao.java

@@ -135,7 +135,7 @@ public class UserDao {
       String encPassword = user.get(ENC_PASSWORD);
       String username = user.get(USER_NAME);
       String password = user.get(PASSWORD);
-      if (!StringUtils.isBlank(password)) {
+      if (StringUtils.isNotBlank(password)) {
         encPassword = CommonUtil.encryptPassword(username, password);
         user.put(PASSWORD, "");
         user.put(ENC_PASSWORD, encPassword);

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/graph/GraphDataGenerator.java

@@ -249,13 +249,13 @@ public class GraphDataGenerator {
           NodeData hostNode = new NodeData();
           String name = (pivotHost.getValue() == null ? "" : "" + pivotHost.getValue());
           String value = "" + pivotHost.getCount();
-          if (!StringUtils.isBlank(name)) {
+          if (StringUtils.isNotBlank(name)) {
             hostNode.setName(name);
           }
-          if (!StringUtils.isBlank(value)) {
+          if (StringUtils.isNotBlank(value)) {
             hostNode.setValue(value);
           }
-          if (!StringUtils.isBlank(firstPriority)) {
+          if (StringUtils.isNotBlank(firstPriority)) {
             hostNode.setType(firstPriority);
           }
 
@@ -263,7 +263,7 @@ public class GraphDataGenerator {
           hostNode.setRoot(true);
           PivotField hostPivot = null;
           for (PivotField searchHost : secondHirarchicalPivotFields) {
-            if (!StringUtils.isBlank(hostNode.getName())
+            if (StringUtils.isNotBlank(hostNode.getName())
               && hostNode.getName().equals(searchHost.getValue())) {
               hostPivot = searchHost;
               break;
@@ -291,7 +291,7 @@ public class GraphDataGenerator {
                 NodeData compNode = new NodeData();
                 String compName = (pivotComp.getValue() == null ? "" : "" + pivotComp.getValue());
                 compNode.setName(compName);
-                if (!StringUtils.isBlank(secondPriority)) {
+                if (StringUtils.isNotBlank(secondPriority)) {
                   compNode.setType(secondPriority);
                 }
                 compNode.setValue("" + pivotComp.getCount());

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/manager/ManagerBase.java

@@ -32,6 +32,7 @@ import org.apache.ambari.logsearch.model.response.LogSearchResponse;
 import org.apache.ambari.logsearch.dao.SolrDaoBase;
 import org.apache.ambari.logsearch.util.JSONUtil;
 import org.apache.ambari.logsearch.util.RESTErrorUtil;
+import org.apache.commons.collections.CollectionUtils;
 import org.apache.log4j.Logger;
 import org.apache.solr.client.solrj.SolrQuery;
 import org.apache.solr.client.solrj.response.QueryResponse;
@@ -110,7 +111,7 @@ public abstract class ManagerBase<LOG_DATA_TYPE extends LogData, SEARCH_RESPONSE
     SEARCH_RESPONSE logResponse = createLogSearchResponse();
     SolrDocumentList docList = response.getResults();
     List<LOG_DATA_TYPE> serviceLogDataList = convertToSolrBeans(response);
-    if (docList != null && !docList.isEmpty()) {
+    if (CollectionUtils.isNotEmpty(docList)) {
       logResponse.setLogList(serviceLogDataList);
       logResponse.setStartIndex((int) docList.getStart());
       logResponse.setTotalCount(docList.getNumFound());

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/manager/ServiceLogsManager.java

@@ -118,7 +118,7 @@ public class ServiceLogsManager extends ManagerBase<SolrServiceLogData, ServiceL
     String keyword = request.getKeyWord();
     Boolean isLastPage = request.isLastPage();
     SimpleQuery solrQuery = conversionService.convert(request, SimpleQuery.class);
-    if (!StringUtils.isBlank(keyword)) {
+    if (StringUtils.isNotBlank(keyword)) {
       try {
         return (ServiceLogResponse) getPageByKeyword(request, event);
       } catch (SolrException | SolrServerException e) {
@@ -170,7 +170,7 @@ public class ServiceLogsManager extends ManagerBase<SolrServiceLogData, ServiceL
     SimpleFacetQuery facetQuery = conversionService.convert(request, SimpleFacetQuery.class);
     SolrQuery solrQuery = new DefaultQueryParser().doConstructSolrQuery(facetQuery);
     String hostName = request.getHostName() == null ? "" : request.getHostName();
-    if (!StringUtils.isBlank(hostName)){
+    if (StringUtils.isNotBlank(hostName)){
       solrQuery.addFilterQuery(String.format("%s:*%s*", HOST, hostName));
     }
     QueryResponse response = serviceLogsSolrDao.process(solrQuery, "/service/logs/tree");
@@ -187,7 +187,7 @@ public class ServiceLogsManager extends ManagerBase<SolrServiceLogData, ServiceL
 
     NodeListResponse list = new NodeListResponse();
     String componentName = request.getComponentName() == null ? "" : request.getComponentName();
-    if (!StringUtils.isBlank(componentName)){
+    if (StringUtils.isNotBlank(componentName)){
       solrQuery.addFilterQuery(COMPONENT + ":"
         + componentName);
       QueryResponse response = serviceLogsSolrDao.process(solrQuery, "/service/logs/hosts/components");

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/manager/UserConfigManager.java

@@ -137,10 +137,10 @@ public class UserConfigManager extends JsonManagerBase {
   }
 
   private boolean isValid(UserConfigData vHistory) {
-    return !StringUtils.isBlank(vHistory.getFiltername())
-        && !StringUtils.isBlank(vHistory.getRowType())
-        && !StringUtils.isBlank(vHistory.getUserName())
-        && !StringUtils.isBlank(vHistory.getValues());
+    return StringUtils.isNotBlank(vHistory.getFiltername())
+        && StringUtils.isNotBlank(vHistory.getRowType())
+        && StringUtils.isNotBlank(vHistory.getUserName())
+        && StringUtils.isNotBlank(vHistory.getValues());
   }
 
   public void deleteUserConfig(String id) {

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/model/response/CommonLogData.java

@@ -18,10 +18,12 @@
  */
 package org.apache.ambari.logsearch.model.response;
 
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 
 import java.util.Date;
+import java.util.Map;
 
 @JsonIgnoreProperties(ignoreUnknown = true)
 public interface CommonLogData extends LogData {
@@ -82,14 +84,14 @@ public interface CommonLogData extends LogData {
   void setEventCount(Long eventCount);
 
   @JsonProperty("event_md5")
-  public String getEventMd5();
+  String getEventMd5();
 
-  public void setEventMd5(String eventMd5);
+  void setEventMd5(String eventMd5);
 
   @JsonProperty("event_dur_ms")
-  public Long getEventDurationMs();
+  Long getEventDurationMs();
 
-  public void setEventDurationMs(Long eventDurationMs);
+  void setEventDurationMs(Long eventDurationMs);
 
   @JsonProperty("_ttl_")
   String getTtl();
@@ -110,4 +112,7 @@ public interface CommonLogData extends LogData {
   Integer getRouterField();
 
   void setRouterField(Integer routerField);
+  
+  @JsonAnyGetter
+  Map<String, Object> getAllDynamicFields();
 }

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/solr/model/SolrAuditLogData.java

@@ -23,7 +23,6 @@ import org.apache.solr.client.solrj.beans.Field;
 
 import java.util.Date;
 import java.util.List;
-import java.util.Map;
 
 import static org.apache.ambari.logsearch.solr.SolrConstants.AuditLogConstants.*;
 

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/solr/model/SolrCommonLogData.java

@@ -22,8 +22,13 @@ import org.apache.ambari.logsearch.model.response.CommonLogData;
 import org.apache.solr.client.solrj.beans.Field;
 
 import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
 
 import static org.apache.ambari.logsearch.solr.SolrConstants.CommonLogConstants.*;
+import static org.apache.ambari.logsearch.solr.SolrConstants.ServiceLogConstants.KEY_DYNAMIC_FIELDS;
+import static org.apache.ambari.logsearch.solr.SolrConstants.ServiceLogConstants.STORED_TOKEN_DYNAMIC_FIELDS;
+import static org.apache.ambari.logsearch.solr.SolrConstants.ServiceLogConstants.WS_DYNAMIC_FIELDS;
 
 public class SolrCommonLogData implements CommonLogData {
 
@@ -78,6 +83,15 @@ public class SolrCommonLogData implements CommonLogData {
   @Field(ROUTER_FIELD)
   private Integer routerField;
 
+  @Field(STORED_TOKEN_DYNAMIC_FIELDS)
+  private Map<String, Object> stdDynamicFields;
+
+  @Field(KEY_DYNAMIC_FIELDS)
+  private Map<String, Object> keyDynamicFields;
+
+  @Field(WS_DYNAMIC_FIELDS)
+  private Map<String, Object> wsDynamicFields;
+
   @Override
   public String getId() {
     return this.id;
@@ -247,4 +261,32 @@ public class SolrCommonLogData implements CommonLogData {
   public void setType(String type) {
     this.type = type;
   }
+
+  @Override
+  public Map<String, Object> getAllDynamicFields() {
+    Map<String, Object> allDynamicFields = new HashMap<>();
+    if (stdDynamicFields != null) {
+      allDynamicFields.putAll(stdDynamicFields);
+    }
+    if (keyDynamicFields != null) {
+      allDynamicFields.putAll(keyDynamicFields);
+    }
+    if (wsDynamicFields != null) {
+      allDynamicFields.putAll(wsDynamicFields);
+    }
+    
+    return allDynamicFields;
+  }
+
+  public void setStdDynamicFields(Map<String, Object> stdDynamicFields) {
+    this.stdDynamicFields = stdDynamicFields;
+  }
+
+  public void setKeyDynamicFields(Map<String, Object> keyDynamicFields) {
+    this.keyDynamicFields = keyDynamicFields;
+  }
+
+  public void setWsDynamicFields(Map<String, Object> wsDynamicFields) {
+    this.wsDynamicFields = wsDynamicFields;
+  }
 }

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/solr/model/SolrServiceLogData.java

@@ -22,7 +22,6 @@ import org.apache.ambari.logsearch.model.response.ServiceLogData;
 import org.apache.solr.client.solrj.beans.Field;
 
 import java.util.Date;
-import java.util.Map;
 
 import static org.apache.ambari.logsearch.solr.SolrConstants.ServiceLogConstants.*;
 
@@ -49,15 +48,6 @@ public class SolrServiceLogData extends SolrCommonLogData implements ServiceLogD
   @Field(HOST)
   private String host;
 
-  @Field(STORED_TOKEN_DYNAMIC_FIELDS)
-  private Map<String, Object> stdDynamicFields;
-
-  @Field(KEY_DYNAMIC_FIELDS)
-  private Map<String, Object> keyDynamicFields;
-
-  @Field(WS_DYNAMIC_FIELDS)
-  private Map<String, Object> wsDynamicFields;
-
   @Override
   public String getPath() {
     return path;
@@ -127,28 +117,4 @@ public class SolrServiceLogData extends SolrCommonLogData implements ServiceLogD
   public void setLevel(String level) {
     this.level = level;
   }
-
-  public Map<String, Object> getStdDynamicFields() {
-    return stdDynamicFields;
-  }
-
-  public void setStdDynamicFields(Map<String, Object> stdDynamicFields) {
-    this.stdDynamicFields = stdDynamicFields;
-  }
-
-  public Map<String, Object> getKeyDynamicFields() {
-    return keyDynamicFields;
-  }
-
-  public void setKeyDynamicFields(Map<String, Object> keyDynamicFields) {
-    this.keyDynamicFields = keyDynamicFields;
-  }
-
-  public Map<String, Object> getWsDynamicFields() {
-    return wsDynamicFields;
-  }
-
-  public void setWsDynamicFields(Map<String, Object> wsDynamicFields) {
-    this.wsDynamicFields = wsDynamicFields;
-  }
 }

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/util/SolrUtil.java

@@ -28,11 +28,13 @@ import org.apache.ambari.logsearch.common.LogSearchConstants;
 import org.apache.lucene.analysis.core.KeywordTokenizerFactory;
 import org.apache.lucene.analysis.path.PathHierarchyTokenizerFactory;
 import org.apache.lucene.analysis.standard.StandardTokenizerFactory;
+import org.apache.lucene.analysis.util.TokenizerFactory;
 import org.apache.solr.client.solrj.SolrQuery;
 import org.apache.solr.schema.TrieDoubleField;
 import org.apache.solr.schema.TrieFloatField;
 import org.apache.solr.schema.TrieIntField;
 import org.apache.solr.schema.TrieLongField;
+import org.apache.commons.collections.MapUtils;
 import org.apache.commons.lang.StringUtils;
 
 public class SolrUtil {
@@ -116,18 +118,7 @@ public class SolrUtil {
     return search;
   }
 
-  public static String makeSolrSearchString(String search) {
-    String newString = search.trim();
-    String newSearch = newString.replaceAll("(?=[]\\[+&|!(){},:\"^~/=$@%?:.\\\\])", "\\\\");
-    newSearch = newSearch.replace("\n", "*");
-    newSearch = newSearch.replace("\t", "*");
-    newSearch = newSearch.replace("\r", "*");
-    newSearch = newSearch.replace("**", "*");
-    newSearch = newSearch.replace("***", "*");
-    return "*" + newSearch + "*";
-  }
-
-  public static String makeSolrSearchStringWithoutAsterisk(String search) {
+  private static String makeSolrSearchStringWithoutAsterisk(String search) {
     String newString = search.trim();
     String newSearch = newString.replaceAll("(?=[]\\[+&|!(){}^\"~=/$@%?:.\\\\])", "\\\\");
     newSearch = newSearch.replace("\n", "*");
@@ -161,28 +152,19 @@ public class SolrUtil {
   }
   
 
-  public static boolean isSolrFieldNumber(String fieldType, Map<String, String> schemaFieldsMap) {
+  private static boolean isSolrFieldNumber(String fieldType, Map<String, String> schemaFieldsMap) {
     if (StringUtils.isBlank(fieldType)) {
       return false;
     } else {
       HashMap<String, Object> typeInfoMap = getFieldTypeInfoMap(fieldType, schemaFieldsMap);
-      if (typeInfoMap == null || typeInfoMap.isEmpty()) {
+      if (MapUtils.isEmpty(typeInfoMap)) {
         return false;
       }
       String fieldTypeClassName = (String) typeInfoMap.get("class");
-      if (fieldTypeClassName.equalsIgnoreCase(TrieIntField.class.getSimpleName())) {
-        return true;
-      }
-      if (fieldTypeClassName.equalsIgnoreCase(TrieDoubleField.class.getSimpleName())) {
-        return true;
-      }
-      if (fieldTypeClassName.equalsIgnoreCase(TrieFloatField.class.getSimpleName())) {
-        return true;
-      }
-      if (fieldTypeClassName.equalsIgnoreCase(TrieLongField.class.getSimpleName())) {
-        return true;
-      }
-      return false;
+      return fieldTypeClassName.equalsIgnoreCase(TrieIntField.class.getSimpleName()) ||
+             fieldTypeClassName.equalsIgnoreCase(TrieDoubleField.class.getSimpleName()) ||
+             fieldTypeClassName.equalsIgnoreCase(TrieFloatField.class.getSimpleName()) ||
+             fieldTypeClassName.equalsIgnoreCase(TrieLongField.class.getSimpleName());
     }
   }
 
@@ -237,7 +219,7 @@ public class SolrUtil {
     }
   }
   
-  public static HashMap<String, Object> getFieldTypeInfoMap(String fieldType, Map<String, String> schemaFieldsTypeMap) {
+  private static HashMap<String, Object> getFieldTypeInfoMap(String fieldType, Map<String, String> schemaFieldsTypeMap) {
     String fieldTypeMetaData = schemaFieldsTypeMap.get(fieldType);
     HashMap<String, Object> fieldTypeMap = JSONUtil.jsonToMapObject(fieldTypeMetaData);
     if (fieldTypeMap == null) {
@@ -273,7 +255,7 @@ public class SolrUtil {
     setFacetLimit(solrQuery, -1);
   }
 
-  public static void setFacetLimit(SolrQuery solrQuery, int limit) {
+  private static void setFacetLimit(SolrQuery solrQuery, int limit) {
     solrQuery.set("facet.limit", limit);
   }
 
@@ -286,22 +268,20 @@ public class SolrUtil {
     }
   }
 
-  private static boolean checkTokenizer(String fieldType, Class tokenizerFactoryClass, Map<String, String> schemaFieldsMap) {
+  @SuppressWarnings("unchecked")
+  private static boolean checkTokenizer(String fieldType, Class<? extends TokenizerFactory> tokenizerFactoryClass,
+      Map<String, String> schemaFieldsMap) {
     HashMap<String, Object> fieldTypeMap = SolrUtil.getFieldTypeInfoMap(fieldType ,schemaFieldsMap);
     HashMap<String, Object> analyzer = (HashMap<String, Object>) fieldTypeMap.get("analyzer");
-    if (analyzer != null) {
-      HashMap<String, Object> tokenizerMap = (HashMap<String, Object>) analyzer.get("tokenizer");
-      if (tokenizerMap != null) {
-        String tokenizerClass = (String) tokenizerMap.get("class");
-        if (!StringUtils.isEmpty(tokenizerClass)) {
-          tokenizerClass =tokenizerClass.replace("solr.", "");
-          if (tokenizerClass.equalsIgnoreCase(tokenizerFactoryClass
-            .getSimpleName())) {
-            return true;
-          }
-        }
+    HashMap<String, Object> tokenizerMap = (HashMap<String, Object>)MapUtils.getObject(analyzer, "tokenizer");
+    if (tokenizerMap != null) {
+      String tokenizerClass = (String) tokenizerMap.get("class");
+      if (StringUtils.isNotEmpty(tokenizerClass)) {
+        tokenizerClass = tokenizerClass.replace("solr.", "");
+        return tokenizerClass.equalsIgnoreCase(tokenizerFactoryClass.getSimpleName());
       }
     }
+    
     return false;
   }
   

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/web/filters/LogsearchKRBAuthenticationFilter.java

@@ -148,7 +148,7 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
       HttpServletResponse response) throws IOException, ServletException {
     logger.debug("LogsearchKRBAuthenticationFilter private filter");
     String userName = getUsernameFromResponse(response);
-    if (!StringUtils.isEmpty(userName)) {
+    if (StringUtils.isNotEmpty(userName)) {
       Authentication existingAuth = SecurityContextHolder.getContext()
           .getAuthentication();
       if (existingAuth == null || !existingAuth.isAuthenticated()) {
@@ -199,7 +199,7 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
       KerberosName.setRules(PropertiesHelper.getProperty(NAME_RULES, "DEFAULT"));
       String userName = getUsernameFromRequest(httpRequest);
       if ((existingAuth == null || !existingAuth.isAuthenticated())
-          && (!StringUtils.isEmpty(userName))) {
+          && (StringUtils.isNotEmpty(userName))) {
         // --------------------------- To Create Logsearch Session--------------------------------------
         // if we get the userName from the token then log into logsearch using the same user
         final List<GrantedAuthority> grantedAuths = new ArrayList<>();
@@ -236,8 +236,8 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
       String keytab = PropertiesHelper.getProperty(KEYTAB);
       String principal = PropertiesHelper.getProperty(PRINCIPAL);
       String hostname = PropertiesHelper.getProperty(HOST_NAME);
-      if (!StringUtils.isEmpty(keytab) && !StringUtils.isEmpty(principal)
-          && !StringUtils.isEmpty(hostname)) {
+      if (StringUtils.isNotEmpty(keytab) && StringUtils.isNotEmpty(principal)
+          && StringUtils.isNotEmpty(hostname)) {
         spnegoEnable = true;
       }
     }
@@ -306,7 +306,7 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
         Iterator<String> iterator = cookiesCollection.iterator();
         while (iterator.hasNext()) {
           String cookie = iterator.next();
-          if (!StringUtils.isEmpty(cookie)) {
+          if (StringUtils.isNotEmpty(cookie)) {
             if (cookie.toLowerCase().startsWith(AUTH_COOKIE_NAME.toLowerCase())) {
               Matcher m = usernamePattern.matcher(cookie);
               if (m.find()) {
@@ -314,7 +314,7 @@ public class LogsearchKRBAuthenticationFilter extends LogsearchKrbFilter {
               }
             }
           }
-          if (!StringUtils.isEmpty(userName)) {
+          if (StringUtils.isNotEmpty(userName)) {
             break;
           }
         }

ambari-logsearch/ambari-logsearch-portal/src/main/java/org/apache/ambari/logsearch/web/security/LdapProperties.java

@@ -63,7 +63,7 @@ public class LdapProperties {
     } else {
       List<String> list = new ArrayList<String>();
       list.add(protocol + primaryUrl);
-      if (!StringUtils.isEmpty(secondaryUrl)) {
+      if (StringUtils.isNotEmpty(secondaryUrl)) {
         list.add(protocol + secondaryUrl);
       }
       return list;

ambari-logsearch/ambari-logsearch-portal/src/main/webapp/scripts/views/audit/AuditTabLayoutView.js

@@ -312,7 +312,7 @@ define(['require',
           if (columns[name] === undefined && value != "_version_") {
             var columnObj = {
               name: Globals.invertedAuditLogMappings[value],
-              label:value,
+              label: value,
               cell: "String",
               sortType: 'toggle',
               editable: false

ambari-logsearch/ambari-logsearch-portal/src/main/webapp/static/schema_fields.json

@@ -65,7 +65,24 @@
     "text": "Text",
     "type": "Type",
     "ugi": "UGI",
-    "reqUser": "User"
+    "reqUser": "User",
+    
+    "ws_base_url": "Base URL",
+    "ws_command": "Command",
+    "ws_component": "Component",
+    "ws_details": "Details",
+    "ws_display_name": "Display Name",
+    "ws_os": "OS",
+    "ws_repo_id": "Repo Id",
+    "ws_repo_version": "Repo Version",
+    "ws_repositories": "Repositories",
+    "ws_result_status": "Result Status",
+    "ws_roles": "Roles",
+    "ws_stack_version": "Stack Version",
+    "ws_stack": "Stack",
+    "ws_status": "Status",
+    "ws_version_note": "Version Note",
+    "ws_version_number": "Version Number"
   },
   "auditLogExcludes": ["tags","tags_str", "seq_num"]
 }

ambari-logsearch/docker/test-config/logfeeder/logfeeder.properties

@@ -22,7 +22,8 @@ logfeeder.config.files=shipper-conf/global.config.json,\
   shipper-conf/input.config-hst.json,\
   shipper-conf/input.config-system_message.json,\
   shipper-conf/input.config-secure_log.json,\
-  shipper-conf/input.config-hdfs.json
+  shipper-conf/input.config-hdfs.json,\
+  shipper-conf/input.config-ambari.json
 logfeeder.log.filter.enable=true
 logfeeder.solr.config.interval=5
 logfeeder.solr.core.config.name=history

ambari-logsearch/docker/test-config/logfeeder/shipper-conf/input.config-ambari.json

@@ -0,0 +1,585 @@
+{
+  "input":[
+    {
+      "type":"ambari_agent",
+      "rowtype":"service",
+      "path":"/root/test-logs/ambari-server/ambari-agent.log"
+    },
+    {
+      "type":"ambari_server",
+      "rowtype":"service",
+      "path":"/root/test-logs/ambari-server/ambari-server.log"
+    },
+    {
+      "type":"ambari_alerts",
+      "rowtype":"service",
+      "add_fields":{
+        "level":"INFO"
+      },
+      "path":"/root/test-logs/ambari-server/ambari-alerts.log"
+    },
+    {
+      "type":"ambari_config_changes",
+      "rowtype":"service",
+      "path":"/root/test-logs/ambari-server/ambari-config-changes.log"
+    },
+    {
+      "type":"ambari_eclipselink",
+      "rowtype":"service",
+      "path":"/root/test-logs/ambari-server/ambari-eclipselink.log"
+    },
+    {
+      "type":"ambari_server_check_database",
+      "rowtype":"service",
+      "path":"/root/test-logs/ambari-server/ambari-server-check-database.log"
+    },
+    {
+      "type":"ambari_audit",
+      "rowtype":"audit",
+      "add_fields":{
+        "logType":"AmbariAudit",
+        "enforcer":"ambari-acl",
+        "repoType":"1",
+        "repo":"ambari",
+        "level":"INFO"
+      },
+      "path":"/root/test-logs/ambari-server/ambari-audit.log"
+    }
+
+  ],
+  "filter":[
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_agent"
+          ]
+
+        }
+
+      },
+      "log4j_format":"",
+      "multiline_pattern":"^(%{LOGLEVEL:level} %{TIMESTAMP_ISO8601:logtime})",
+      "message_pattern":"(?m)^%{LOGLEVEL:level} %{TIMESTAMP_ISO8601:logtime} %{JAVAFILE:file}:%{INT:line_number} - %{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "logtime":{
+          "map_date":{
+            "target_date_pattern":"yyyy-MM-dd HH:mm:ss,SSS"
+          }
+
+        },
+        "level":{
+          "map_fieldvalue":{
+            "pre_value":"WARNING",
+            "post_value":"WARN"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_server"
+          ]
+          
+        }
+        
+      },
+      "log4j_format":"%d{DATE} %5p [%t] %c{1}:%L - %m%n",
+      "multiline_pattern":"^(%{USER_SYNC_DATE:logtime})",
+      "message_pattern":"(?m)^%{USER_SYNC_DATE:logtime}%{SPACE}%{LOGLEVEL:level}%{SPACE}\\[%{DATA:thread_name}\\]%{SPACE}%{JAVACLASS:logger_name}:%{INT:line_number}%{SPACE}-%{SPACE}%{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "logtime":{
+          "map_date":{
+            "target_date_pattern":"dd MMM yyyy HH:mm:ss"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_alerts"
+          ]
+          
+        }
+        
+      },
+      "log4j_format":"%d{DATE} %5p [%t] %c{1}:%L - %m%n",
+      "multiline_pattern":"^(%{TIMESTAMP_ISO8601:logtime})",
+      "message_pattern":"(?m)^%{TIMESTAMP_ISO8601:logtime}%{SPACE}%{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "logtime":{
+          "map_date":{
+            "target_date_pattern":"yyyy-MM-dd HH:mm:ss,SSS"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_config_changes"
+          ]
+          
+        }
+        
+      },
+      "log4j_format":"%d{DATE} %5p [%t] %c{1}:%L - %m%n",
+      "multiline_pattern":"^(%{TIMESTAMP_ISO8601:logtime})",
+      "message_pattern":"(?m)^%{TIMESTAMP_ISO8601:logtime}%{SPACE}%{LOGLEVEL:level}%{SPACE}-%{SPACE}%{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "logtime":{
+          "map_date":{
+            "target_date_pattern":"yyyy-MM-dd HH:mm:ss,SSS"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_eclipselink"
+          ]
+          
+        }
+        
+      },
+      "log4j_format":"%d{DATE} %5p [%t] %c{1}:%L - %m%n",
+      "multiline_pattern":"^(\\[EL%{SPACE}%{LOGLEVEL:level}\\])",
+      "message_pattern":"(?m)^\\[EL%{SPACE}%{LOGLEVEL:level}\\]:%{SPACE}%{TIMESTAMP_ISO8601:logtime}%{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "logtime":{
+          "map_date":{
+            "target_date_pattern":"yyyy-MM-dd HH:mm:ss.SSS"
+          }
+
+        },
+        "level":{
+          "map_fieldvalue":{
+            "pre_value":"Warning",
+            "post_value":"Warn"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_server_check_database"
+          ]
+          
+        }
+        
+      },
+      "log4j_format":"%d{DATE} %5p [%t] %c{1}:%L - %m%n",
+      "multiline_pattern":"^(%{TIMESTAMP_ISO8601:logtime})",
+      "message_pattern":"(?m)^%{TIMESTAMP_ISO8601:logtime}%{SPACE}%{LOGLEVEL:level}%{SPACE}-%{SPACE}%{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "logtime":{
+          "map_date":{
+            "target_date_pattern":"yyyy-MM-dd HH:mm:ss,SSS"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"grok",
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_audit"
+          ]
+
+        }
+
+      },
+      "log4j_format":"%d{ISO8601} %-5p %c{2} (%F:%M(%L)) - %m%n",
+      "multiline_pattern":"^(%{TIMESTAMP_ISO8601:evtTime})",
+      "message_pattern":"(?m)^%{TIMESTAMP_ISO8601:evtTime},%{SPACE}%{GREEDYDATA:log_message}",
+      "post_map_values":{
+        "evtTime":{
+          "map_date":{
+            "target_date_pattern":"yyyy-MM-dd'T'HH:mm:ss.SSSXX"
+          }
+
+        }
+
+      }
+
+    },
+    {
+      "filter":"keyvalue",
+      "sort_order":1,
+      "conditions":{
+        "fields":{
+          "type":[
+            "ambari_audit"
+          ]
+
+        }
+
+      },
+      "source_field":"log_message",
+      "field_split":", ",
+      "value_borders":"()",
+      "post_map_values":{
+        "User":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"reqUser"
+          }
+        },
+        "Hostname":{
+          "map_fieldname":{
+            "new_fieldname":"host"
+          }
+        },
+        "Host name":{
+          "map_fieldname":{
+            "new_fieldname":"host"
+          }
+        },
+        "RemoteIp":{
+          "map_fieldname":{
+            "new_fieldname":"cliIP"
+          }
+        },
+        "RequestType":{
+          "map_fieldname":{
+            "new_fieldname":"cliType"
+          }
+        },
+        "RequestId":{
+          "map_fieldname":{
+            "new_fieldname":"request_id"
+          }
+        },
+        "TaskId":{
+          "map_fieldname":{
+            "new_fieldname":"task_id"
+          }
+        },
+        "Operation":{
+          "map_fieldname":{
+            "new_fieldname":"action"
+          }
+        },
+        "url":{
+          "map_fieldname":{
+            "new_fieldname":"resource"
+          }
+        },
+        "ResourcePath":{
+          "map_fieldname":{
+            "new_fieldname":"resource"
+          }
+        },
+        "Cluster name":{
+          "map_fieldname":{
+            "new_fieldname":"cluster"
+          }
+        },
+        "Reason":{
+          "map_fieldname":{
+            "new_fieldname":"reason"
+          }
+        },
+        "Base URL":{
+          "map_fieldname":{
+            "new_fieldname":"ws_base_url"
+          }
+        },
+        "Command":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_command"
+          }
+        },
+        "Component":{
+          "map_fieldname":{
+            "new_fieldname":"ws_component"
+          }
+        },
+        "Details":{
+          "map_fieldname":{
+            "new_fieldname":"ws_details"
+          }
+        },
+        "Display name":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_display_name"
+          }
+        },
+        "OS":{
+          "map_fieldname":{
+            "new_fieldname":"ws_os"
+          }
+        },
+        "Repo id":{
+          "map_fieldname":{
+            "new_fieldname":"ws_repo_id"
+          }
+        },
+        "Repo version":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_repo_version"
+          }
+        },
+        "Repositories":{
+          "map_fieldname":{
+            "new_fieldname":"ws_repositories"
+          }
+        },
+        "Roles":{
+          "map_fieldname":{
+            "new_fieldname":"ws_roles"
+          }
+        },
+        "Stack":{
+          "map_fieldname":{
+            "new_fieldname":"ws_stack"
+          }
+        },
+        "Stack version":{
+          "map_fieldname":{
+            "new_fieldname":"ws_stack_version"
+          }
+        },
+        "VersionNote":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_version_note"
+          }
+        },
+        "VersionNumber":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_version_number"
+          }
+        },
+        "Status":[
+         {
+           "map_fieldcopy":{
+             "copy_name": "ws_status"
+           }
+         },
+         {
+            "map_fieldvalue":{
+              "pre_value":"Success",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"Successfully queued",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"QUEUED",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"PENDING",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"COMPLETED",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"IN_PROGRESS",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"Failed",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"Failed to queue",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"HOLDING",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"HOLDING_FAILED",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"HOLDING_TIMEDOUT",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"FAILED",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"TIMEDOUT",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"ABORTED",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"SKIPPED_FAILED",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldname":{
+              "new_fieldname":"result"
+            }
+          }
+        ],
+        "ResultStatus":[
+          {
+            "map_fieldcopy":{
+              "copy_name": "ws_result_status"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"200 OK",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"201 Created",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"202 Accepted",
+              "post_value":"1"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"400 Bad Request",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"401 Unauthorized",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"403 Forbidden",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"404 Not Found",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"409 Resource Conflict",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldvalue":{
+              "pre_value":"500 Internal Server Error",
+              "post_value":"0"
+            }
+          },
+          {
+            "map_fieldname":{
+              "new_fieldname":"result"
+            }
+          }
+        ]
+
+      }
+
+    }
+
+  ]
+
+}

ambari-logsearch/docker/test-logs/ambari-server/ambari-audit.log

@@ -0,0 +1,390 @@
+2016-10-03T16:26:13.333Z, User(admin), RemoteIp(192.168.64.1), Operation(User login), Roles(
+    Ambari: Ambari Administrator
+), Status(Success)
+2016-10-03T16:26:54.834Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/redhat6/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(redhat6), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/centos6)
+2016-10-03T16:26:54.845Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/redhat7/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(redhat7), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/centos7/2.x/updates/2.5.0.0/)
+2016-10-03T16:26:54.847Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/redhat6/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(redhat6), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/centos6/2.x/updates/2.5.0.0/)
+2016-10-03T16:26:54.857Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/debian7/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(debian7), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/debian7)
+2016-10-03T16:26:54.857Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/redhat7/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(redhat7), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/centos7)
+2016-10-03T16:26:54.860Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/debian7/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(debian7), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/debian7/2.x/updates/2.5.0.0)
+2016-10-03T16:26:54.935Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/suse12/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(suse12), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/sles12)
+2016-10-03T16:26:54.943Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/suse11/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(suse11), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/suse11sp3/2.x/updates/2.5.0.0)
+2016-10-03T16:26:54.945Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/ubuntu12/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(ubuntu12), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/ubuntu12/2.x/updates/2.5.0.0)
+2016-10-03T16:26:54.951Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/suse12/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(suse12), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/sles12/2.x/updates/2.5.0.0)
+2016-10-03T16:26:54.954Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/suse11/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(suse11), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/suse11sp3)
+2016-10-03T16:26:54.959Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/ubuntu12/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(ubuntu12), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/ubuntu12)
+2016-10-03T16:26:54.997Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/ubuntu14/repositories/HDP-2.5), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(ubuntu14), Repo id(HDP-2.5), Base URL(http://public-repo-1.hortonworks.com/HDP/ubuntu14/2.x/updates/2.5.0.0)
+2016-10-03T16:26:55.003Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository update), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/operating_systems/ubuntu14/repositories/HDP-UTILS-1.1.0.21), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), OS(ubuntu14), Repo id(HDP-UTILS-1.1.0.21), Base URL(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/ubuntu14)
+2016-10-03T16:26:58.669Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:27:20.063Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:27:24.185Z, User(admin), RemoteIp(192.168.64.1), Operation(Request from server), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/requests), ResultStatus(202 Accepted), Command(null), Cluster name(null)
+2016-10-03T16:27:24.206Z, User(admin), Operation(Check host), Status(IN_PROGRESS), RequestId(1)
+2016-10-03T16:27:24.207Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(1), TaskId(2), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:27:24.211Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(1), TaskId(3), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:27:24.213Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(1), TaskId(4), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:27:24.214Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(1), TaskId(5), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:27:25.836Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(1), TaskId(2), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:27:26.824Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(1), TaskId(3), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:27:27.830Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(1), TaskId(5), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:27:28.831Z, User(admin), Operation(Check host), Status(COMPLETED), RequestId(1)
+2016-10-03T16:27:28.833Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(1), TaskId(4), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:27:29.428Z, User(admin), RemoteIp(192.168.64.1), Operation(Request from server), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/requests), ResultStatus(202 Accepted), Command(null), Cluster name(null)
+2016-10-03T16:27:29.440Z, User(admin), Operation(Check host), Status(IN_PROGRESS), RequestId(2)
+2016-10-03T16:27:29.443Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(2), TaskId(6), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:27:29.443Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(2), TaskId(7), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:27:29.444Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(2), TaskId(8), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:27:29.444Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(QUEUED), RequestId(2), TaskId(9), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:27:38.816Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(2), TaskId(7), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:27:39.818Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(2), TaskId(9), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:27:40.822Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(2), TaskId(8), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:27:42.817Z, User(admin), Operation(Check host), Status(COMPLETED), RequestId(2)
+2016-10-03T16:27:42.818Z, User(admin), Operation(ACTIONEXECUTE check_host), Status(COMPLETED), RequestId(2), TaskId(6), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:28:19.410Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:28:49.829Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:28:56.413Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:29:02.762Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:29:20.084Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:29:30.390Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions), ResultStatus(201 Created)
+2016-10-03T16:29:30.430Z, User(admin), RemoteIp(192.168.64.1), Operation(Repository version change), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/stacks/HDP/versions/2.5/repository_versions/1), ResultStatus(200 OK), Stack(HDP), Stack version(2.5), Display name(null), Repo version(null), Repositories(
+Operating system: debian7
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/debian7/2.x/updates/2.5.0.0)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/debian7)
+Operating system: redhat6
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/centos6/2.x/updates/2.5.0.0/)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/centos6)
+Operating system: redhat7
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/centos7/2.x/updates/2.5.0.0/)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/centos7)
+Operating system: suse11
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/suse11sp3/2.x/updates/2.5.0.0)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/suse11sp3)
+Operating system: suse12
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/sles12/2.x/updates/2.5.0.0)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/sles12)
+Operating system: ubuntu12
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/ubuntu12/2.x/updates/2.5.0.0)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/ubuntu12)
+Operating system: ubuntu14
+    Repository ID(HDP-2.5), Repository name(HDP), Base url(http://public-repo-1.hortonworks.com/HDP/ubuntu14/2.x/updates/2.5.0.0)
+    Repository ID(HDP-UTILS-1.1.0.21), Repository name(HDP-UTILS), Base url(http://public-repo-1.hortonworks.com/HDP-UTILS-1.1.0.21/repos/ubuntu14)
+)
+2016-10-03T16:29:30.578Z, User(admin), RemoteIp(192.168.64.1), Operation(Configuration change), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster), ResultStatus(201 Created), VersionNumber(Vnull), VersionNote(null)
+2016-10-03T16:29:30.828Z, User(admin), RemoteIp(192.168.64.1), Operation(null), RequestId(null), Status(Successfully queued)
+2016-10-03T16:29:32.696Z, User(admin), RemoteIp(192.168.64.1), Operation(Configuration change), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster), ResultStatus(200 OK), VersionNumber(V1), VersionNote(Initial configurations for HDFS)
+2016-10-03T16:29:32.890Z, User(admin), RemoteIp(192.168.64.1), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/services?ServiceInfo/service_name=HDFS), ResultStatus(201 Created)
+2016-10-03T16:29:32.996Z, User(admin), RemoteIp(192.168.64.1), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/services?ServiceInfo/service_name=ZOOKEEPER), ResultStatus(201 Created)
+2016-10-03T16:29:33.044Z, User(admin), RemoteIp(192.168.64.1), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/services?ServiceInfo/service_name=AMBARI_INFRA), ResultStatus(201 Created)
+2016-10-03T16:29:33.099Z, User(admin), RemoteIp(192.168.64.1), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/services?ServiceInfo/service_name=AMBARI_METRICS), ResultStatus(201 Created)
+2016-10-03T16:29:33.239Z, User(admin), RemoteIp(192.168.64.1), Operation(Host addition), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:29:33.359Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(NAMENODE)
+2016-10-03T16:29:33.428Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(SECONDARY_NAMENODE)
+2016-10-03T16:29:33.516Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(ZOOKEEPER_SERVER)
+2016-10-03T16:29:33.562Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(INFRA_SOLR)
+2016-10-03T16:29:33.629Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(METRICS_GRAFANA)
+2016-10-03T16:29:33.672Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(METRICS_COLLECTOR)
+2016-10-03T16:29:33.780Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(DATANODE)
+2016-10-03T16:29:33.851Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(HDFS_CLIENT)
+2016-10-03T16:29:33.926Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(ZOOKEEPER_CLIENT)
+2016-10-03T16:29:33.988Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(INFRA_SOLR_CLIENT)
+2016-10-03T16:29:34.107Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(METRICS_MONITOR)
+2016-10-03T16:29:34.814Z, User(admin), RemoteIp(192.168.64.1), Operation(INSTALLED: all services (myCluster)), RequestId(3), Status(Successfully queued)
+2016-10-03T16:29:35.035Z, User(admin), Operation(Install Services), Status(IN_PROGRESS), RequestId(3)
+2016-10-03T16:29:35.035Z, User(admin), Operation(INSTALL DATANODE), Status(QUEUED), RequestId(3), TaskId(10), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.036Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(QUEUED), RequestId(3), TaskId(11), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.036Z, User(admin), Operation(INSTALL INFRA_SOLR), Status(QUEUED), RequestId(3), TaskId(12), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.036Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(QUEUED), RequestId(3), TaskId(13), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.037Z, User(admin), Operation(INSTALL METRICS_GRAFANA), Status(QUEUED), RequestId(3), TaskId(14), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.043Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(QUEUED), RequestId(3), TaskId(15), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.043Z, User(admin), Operation(INSTALL NAMENODE), Status(QUEUED), RequestId(3), TaskId(16), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.043Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(QUEUED), RequestId(3), TaskId(17), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.045Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(QUEUED), RequestId(3), TaskId(18), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:29:35.046Z, User(admin), Operation(INSTALL DATANODE), Status(QUEUED), RequestId(3), TaskId(19), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:29:35.047Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(QUEUED), RequestId(3), TaskId(20), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:29:35.047Z, User(admin), Operation(INSTALL SECONDARY_NAMENODE), Status(QUEUED), RequestId(3), TaskId(21), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:29:35.047Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(QUEUED), RequestId(3), TaskId(22), Hostname(c6402.ambari.apache.org)
+2016-10-03T16:29:35.048Z, User(admin), Operation(INSTALL DATANODE), Status(QUEUED), RequestId(3), TaskId(23), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:29:35.051Z, User(admin), Operation(INSTALL METRICS_COLLECTOR), Status(QUEUED), RequestId(3), TaskId(24), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:29:35.052Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(QUEUED), RequestId(3), TaskId(25), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:29:35.052Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(QUEUED), RequestId(3), TaskId(26), Hostname(c6403.ambari.apache.org)
+2016-10-03T16:29:35.052Z, User(admin), Operation(INSTALL DATANODE), Status(QUEUED), RequestId(3), TaskId(27), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:29:35.053Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(QUEUED), RequestId(3), TaskId(28), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:29:35.053Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(QUEUED), RequestId(3), TaskId(29), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:29:35.057Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(QUEUED), RequestId(3), TaskId(30), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:29:35.059Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(QUEUED), RequestId(3), TaskId(31), Hostname(c6404.ambari.apache.org)
+2016-10-03T16:29:35.629Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T16:53:55.860Z, User(admin), Operation(INSTALL DATANODE), Status(COMPLETED), RequestId(3), TaskId(10), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:53:56.837Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(COMPLETED), RequestId(3), TaskId(11), Hostname(c6401.ambari.apache.org)
+2016-10-03T16:58:35.834Z, User(admin), Operation(INSTALL DATANODE), Status(COMPLETED), RequestId(3), TaskId(19), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:00:08.822Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(COMPLETED), RequestId(3), TaskId(20), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:00:09.827Z, User(admin), Operation(INSTALL SECONDARY_NAMENODE), Status(COMPLETED), RequestId(3), TaskId(21), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:00:10.831Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(COMPLETED), RequestId(3), TaskId(22), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:00:15.818Z, User(admin), Operation(Install Services), Status(FAILED), RequestId(3)
+2016-10-03T17:00:15.818Z, User(admin), Operation(INSTALL DATANODE), Status(FAILED), RequestId(3), TaskId(23), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:00:16.820Z, User(admin), Operation(INSTALL DATANODE), Status(FAILED), RequestId(3), TaskId(27), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:00:23.828Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(COMPLETED), RequestId(3), TaskId(28), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:00:54.818Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(COMPLETED), RequestId(3), TaskId(29), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:01:39.826Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(COMPLETED), RequestId(3), TaskId(30), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:01:41.825Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(COMPLETED), RequestId(3), TaskId(31), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:31.822Z, User(admin), Operation(INSTALL INFRA_SOLR), Status(FAILED), RequestId(3), TaskId(12), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:31.839Z, User(admin), Operation(INSTALL METRICS_COLLECTOR), Status(FAILED), RequestId(3), TaskId(24), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:32.252Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(ABORTED), RequestId(3), TaskId(13), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:32.253Z, User(admin), Operation(INSTALL METRICS_GRAFANA), Status(ABORTED), RequestId(3), TaskId(14), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:32.253Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(ABORTED), RequestId(3), TaskId(15), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:32.253Z, User(admin), Operation(INSTALL NAMENODE), Status(ABORTED), RequestId(3), TaskId(16), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:32.253Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(ABORTED), RequestId(3), TaskId(17), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:32.257Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(ABORTED), RequestId(3), TaskId(18), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:32.257Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(ABORTED), RequestId(3), TaskId(25), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:32.257Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(ABORTED), RequestId(3), TaskId(26), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:48.818Z, User(admin), RemoteIp(192.168.64.1), Operation(INSTALLED: all services on all hosts (myCluster)), RequestId(4), Status(Successfully queued)
+2016-10-03T17:02:48.875Z, User(admin), Operation(Install Components), Status(IN_PROGRESS), RequestId(4)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(QUEUED), RequestId(4), TaskId(32), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL INFRA_SOLR), Status(QUEUED), RequestId(4), TaskId(33), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(QUEUED), RequestId(4), TaskId(34), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL METRICS_GRAFANA), Status(QUEUED), RequestId(4), TaskId(35), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(QUEUED), RequestId(4), TaskId(36), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL NAMENODE), Status(QUEUED), RequestId(4), TaskId(37), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(QUEUED), RequestId(4), TaskId(38), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.875Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(QUEUED), RequestId(4), TaskId(39), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:48.876Z, User(admin), Operation(INSTALL DATANODE), Status(QUEUED), RequestId(4), TaskId(40), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:48.876Z, User(admin), Operation(INSTALL METRICS_COLLECTOR), Status(QUEUED), RequestId(4), TaskId(41), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:48.876Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(QUEUED), RequestId(4), TaskId(42), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:48.876Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(QUEUED), RequestId(4), TaskId(43), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:48.876Z, User(admin), Operation(INSTALL DATANODE), Status(QUEUED), RequestId(4), TaskId(44), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:48.878Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(QUEUED), RequestId(4), TaskId(45), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:48.878Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(QUEUED), RequestId(4), TaskId(46), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:48.878Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(QUEUED), RequestId(4), TaskId(47), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:50.836Z, User(admin), Operation(INSTALL DATANODE), Status(COMPLETED), RequestId(4), TaskId(44), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:51.825Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(COMPLETED), RequestId(4), TaskId(32), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:02:51.836Z, User(admin), Operation(INSTALL HDFS_CLIENT), Status(COMPLETED), RequestId(4), TaskId(45), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:52.821Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(COMPLETED), RequestId(4), TaskId(46), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:02:52.855Z, User(admin), Operation(INSTALL DATANODE), Status(COMPLETED), RequestId(4), TaskId(40), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:02:53.817Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(COMPLETED), RequestId(4), TaskId(47), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:03:38.840Z, User(admin), Operation(INSTALL INFRA_SOLR), Status(COMPLETED), RequestId(4), TaskId(33), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:03:39.821Z, User(admin), Operation(INSTALL INFRA_SOLR_CLIENT), Status(COMPLETED), RequestId(4), TaskId(34), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:04:32.819Z, User(admin), Operation(INSTALL METRICS_GRAFANA), Status(COMPLETED), RequestId(4), TaskId(35), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:04:34.827Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(COMPLETED), RequestId(4), TaskId(36), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:04:35.841Z, User(admin), Operation(INSTALL NAMENODE), Status(COMPLETED), RequestId(4), TaskId(37), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:04:37.835Z, User(admin), Operation(INSTALL ZOOKEEPER_CLIENT), Status(COMPLETED), RequestId(4), TaskId(38), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:04:37.836Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(COMPLETED), RequestId(4), TaskId(39), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:09.821Z, User(admin), Operation(INSTALL METRICS_COLLECTOR), Status(COMPLETED), RequestId(4), TaskId(41), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:09.844Z, User(admin), Operation(INSTALL METRICS_MONITOR), Status(COMPLETED), RequestId(4), TaskId(42), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:11.839Z, User(admin), Operation(Install Components), Status(COMPLETED), RequestId(4)
+2016-10-03T17:07:11.839Z, User(admin), Operation(INSTALL ZOOKEEPER_SERVER), Status(COMPLETED), RequestId(4), TaskId(43), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:14.709Z, User(admin), RemoteIp(192.168.64.1), Operation(STARTED: all services (myCluster)), RequestId(5), Status(Successfully queued)
+2016-10-03T17:07:14.751Z, User(admin), Operation(Start Services), Status(IN_PROGRESS), RequestId(5)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START METRICS_MONITOR), Status(QUEUED), RequestId(5), TaskId(48), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START ZOOKEEPER_SERVER), Status(QUEUED), RequestId(5), TaskId(49), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START METRICS_MONITOR), Status(QUEUED), RequestId(5), TaskId(50), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START ZOOKEEPER_SERVER), Status(QUEUED), RequestId(5), TaskId(51), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START METRICS_MONITOR), Status(QUEUED), RequestId(5), TaskId(52), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START ZOOKEEPER_SERVER), Status(QUEUED), RequestId(5), TaskId(53), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:14.751Z, User(admin), Operation(START METRICS_MONITOR), Status(QUEUED), RequestId(5), TaskId(54), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:07:18.817Z, User(admin), Operation(START METRICS_MONITOR), Status(COMPLETED), RequestId(5), TaskId(52), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:18.823Z, User(admin), Operation(START METRICS_MONITOR), Status(COMPLETED), RequestId(5), TaskId(50), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:07:18.830Z, User(admin), Operation(START METRICS_MONITOR), Status(COMPLETED), RequestId(5), TaskId(54), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:07:19.900Z, User(admin), Operation(START METRICS_MONITOR), Status(COMPLETED), RequestId(5), TaskId(48), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:19.918Z, User(admin), Operation(START ZOOKEEPER_SERVER), Status(COMPLETED), RequestId(5), TaskId(53), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:19.935Z, User(admin), Operation(START ZOOKEEPER_SERVER), Status(COMPLETED), RequestId(5), TaskId(51), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:07:21.820Z, User(admin), Operation(START ZOOKEEPER_SERVER), Status(COMPLETED), RequestId(5), TaskId(49), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:22.836Z, User(admin), Operation(START INFRA_SOLR), Status(QUEUED), RequestId(5), TaskId(55), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:22.836Z, User(admin), Operation(SERVICE_CHECK ZOOKEEPER_QUORUM_SERVICE_CHECK), Details(SERVICE_CHECK ZOOKEEPER), Status(QUEUED), RequestId(5), TaskId(56), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:37.819Z, User(admin), Operation(START INFRA_SOLR), Status(COMPLETED), RequestId(5), TaskId(55), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:46.825Z, User(admin), Operation(SERVICE_CHECK ZOOKEEPER_QUORUM_SERVICE_CHECK), Details(SERVICE_CHECK ZOOKEEPER), Status(COMPLETED), RequestId(5), TaskId(56), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:47.041Z, User(admin), Operation(SERVICE_CHECK AMBARI_INFRA_SERVICE_CHECK), Details(SERVICE_CHECK AMBARI_INFRA), Status(QUEUED), RequestId(5), TaskId(57), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:47.041Z, User(admin), Operation(START DATANODE), Status(QUEUED), RequestId(5), TaskId(58), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:47.041Z, User(admin), Operation(START NAMENODE), Status(QUEUED), RequestId(5), TaskId(59), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:47.041Z, User(admin), Operation(START DATANODE), Status(QUEUED), RequestId(5), TaskId(60), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:07:47.041Z, User(admin), Operation(START DATANODE), Status(QUEUED), RequestId(5), TaskId(61), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:47.042Z, User(admin), Operation(START DATANODE), Status(QUEUED), RequestId(5), TaskId(62), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:07:48.823Z, User(admin), Operation(SERVICE_CHECK AMBARI_INFRA_SERVICE_CHECK), Details(SERVICE_CHECK AMBARI_INFRA), Status(COMPLETED), RequestId(5), TaskId(57), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:07:52.828Z, User(admin), Operation(START DATANODE), Status(COMPLETED), RequestId(5), TaskId(61), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:07:52.844Z, User(admin), Operation(START DATANODE), Status(COMPLETED), RequestId(5), TaskId(60), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:07:53.820Z, User(admin), Operation(START DATANODE), Status(COMPLETED), RequestId(5), TaskId(62), Hostname(c6404.ambari.apache.org)
+2016-10-03T17:07:53.833Z, User(admin), Operation(START DATANODE), Status(COMPLETED), RequestId(5), TaskId(58), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:08:13.818Z, User(admin), Operation(START NAMENODE), Status(COMPLETED), RequestId(5), TaskId(59), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:08:14.280Z, User(admin), Operation(START SECONDARY_NAMENODE), Status(QUEUED), RequestId(5), TaskId(63), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:08:20.821Z, User(admin), Operation(START SECONDARY_NAMENODE), Status(COMPLETED), RequestId(5), TaskId(63), Hostname(c6402.ambari.apache.org)
+2016-10-03T17:08:21.333Z, User(admin), Operation(SERVICE_CHECK HDFS_SERVICE_CHECK), Details(SERVICE_CHECK HDFS), Status(QUEUED), RequestId(5), TaskId(64), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:08:21.334Z, User(admin), Operation(START METRICS_COLLECTOR), Status(QUEUED), RequestId(5), TaskId(65), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:08:29.815Z, User(admin), Operation(SERVICE_CHECK HDFS_SERVICE_CHECK), Details(SERVICE_CHECK HDFS), Status(COMPLETED), RequestId(5), TaskId(64), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:09:17.819Z, User(admin), Operation(START METRICS_COLLECTOR), Status(COMPLETED), RequestId(5), TaskId(65), Hostname(c6403.ambari.apache.org)
+2016-10-03T17:09:18.621Z, User(admin), Operation(SERVICE_CHECK AMBARI_METRICS_SERVICE_CHECK), Details(SERVICE_CHECK AMBARI_METRICS), Status(QUEUED), RequestId(5), TaskId(66), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:09:18.621Z, User(admin), Operation(START METRICS_GRAFANA), Status(QUEUED), RequestId(5), TaskId(67), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:09:39.816Z, User(admin), Operation(SERVICE_CHECK AMBARI_METRICS_SERVICE_CHECK), Details(SERVICE_CHECK AMBARI_METRICS), Status(COMPLETED), RequestId(5), TaskId(66), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:09:43.823Z, User(admin), Operation(Start Services), Status(COMPLETED), RequestId(5)
+2016-10-03T17:09:43.824Z, User(admin), Operation(START METRICS_GRAFANA), Status(COMPLETED), RequestId(5), TaskId(67), Hostname(c6401.ambari.apache.org)
+2016-10-03T17:14:46.087Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/version_definitions?dry_run=true), ResultStatus(201 Created)
+2016-10-03T17:14:56.802Z, User(admin), RemoteIp(192.168.64.1), Operation(Configuration change), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster), ResultStatus(200 OK), VersionNumber(Vnull), VersionNote(null)
+2016-10-04T05:55:42.000Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.020Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.024Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.027Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.029Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.033Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.045Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.047Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.049Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.051Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.054Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.055Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.057Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.061Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.064Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.068Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.070Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.072Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.074Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.078Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.080Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.081Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.083Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.085Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.087Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.088Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.090Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.091Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.092Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.100Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.100Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.102Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.103Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.104Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.105Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.107Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.108Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.109Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.110Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:42.130Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T05:55:44.919Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:02:57.511Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:02:59.309Z, User(admin), RemoteIp(192.168.64.1), Operation(User login), Roles(
+    Ambari: Ambari Administrator
+), Status(Success)
+2016-10-04T08:05:40.063Z, User(admin), RemoteIp(192.168.64.1), RequestType(POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/widget_layouts), ResultStatus(201 Created)
+2016-10-04T08:05:40.085Z, User(admin), RemoteIp(192.168.64.1), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/users/admin/activeWidgetLayouts/), ResultStatus(200 OK)
+2016-10-04T08:11:45.150Z, User(admin), RemoteIp(192.168.64.1), Operation(STARTED: METRICS_COLLECTOR/AMBARI_METRICS on c6403.ambari.apache.org (myCluster)), Host name(c6403.ambari.apache.org), RequestId(6), Status(Successfully queued)
+2016-10-04T08:11:45.221Z, User(admin), Operation(Start Metrics Collector), Status(IN_PROGRESS), RequestId(6)
+2016-10-04T08:11:45.222Z, User(admin), Operation(START METRICS_COLLECTOR), Status(QUEUED), RequestId(6), TaskId(102), Hostname(c6403.ambari.apache.org)
+2016-10-04T08:15:30.413Z, User(admin), Operation(Start Metrics Collector), Status(COMPLETED), RequestId(6)
+2016-10-04T08:15:30.414Z, User(admin), Operation(START METRICS_COLLECTOR), Status(COMPLETED), RequestId(6), TaskId(102), Hostname(c6403.ambari.apache.org)
+2016-10-04T08:17:44.550Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.552Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.554Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.556Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.557Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.559Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.561Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.564Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:44.595Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:45.370Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-04T08:17:45.495Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-05T12:06:48.400Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-05T12:13:51.541Z, User(admin), RemoteIp(192.168.64.1), Operation(User login), Roles(
+    Ambari: Ambari Administrator
+), Status(Success)
+2016-10-05T12:14:27.945Z, User(admin), RemoteIp(192.168.64.1), Operation(null), RequestId(null), Status(Successfully queued)
+2016-10-05T12:14:28.414Z, User(admin), RemoteIp(192.168.64.1), Operation(Configuration change), RequestType(PUT), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster), ResultStatus(200 OK), VersionNumber(V1), VersionNote(Initial configurations for Log Search)
+2016-10-05T12:14:28.562Z, User(admin), RemoteIp(192.168.64.1), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/services?ServiceInfo/service_name=LOGSEARCH), ResultStatus(201 Created)
+2016-10-05T12:14:28.630Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(LOGSEARCH_SERVER)
+2016-10-05T12:14:28.744Z, User(admin), RemoteIp(192.168.64.1), Operation(Component addition to host), RequestType(QUERY_POST), url(http://c6401.ambari.apache.org:8080/api/v1/clusters/myCluster/hosts), ResultStatus(201 Created), Hostname(null), Component(LOGSEARCH_LOGFEEDER)
+2016-10-05T12:14:29.066Z, User(admin), RemoteIp(192.168.64.1), Operation(INSTALLED: all services (myCluster)), RequestId(7), Status(Successfully queued)
+2016-10-05T12:14:29.138Z, User(admin), Operation(Install Services), Status(IN_PROGRESS), RequestId(7)
+2016-10-05T12:14:29.146Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(7), TaskId(152), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:14:29.147Z, User(admin), Operation(INSTALL LOGSEARCH_SERVER), Status(QUEUED), RequestId(7), TaskId(153), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:14:29.147Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(7), TaskId(154), Hostname(c6402.ambari.apache.org)
+2016-10-05T12:14:29.148Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(7), TaskId(155), Hostname(c6403.ambari.apache.org)
+2016-10-05T12:14:29.151Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(7), TaskId(156), Hostname(c6404.ambari.apache.org)
+2016-10-05T12:14:32.964Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(7), TaskId(152), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:14:34.925Z, User(admin), Operation(INSTALL LOGSEARCH_SERVER), Status(COMPLETED), RequestId(7), TaskId(153), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:14:52.942Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(7), TaskId(155), Hostname(c6403.ambari.apache.org)
+2016-10-05T12:14:52.965Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(7), TaskId(156), Hostname(c6404.ambari.apache.org)
+2016-10-05T12:15:06.922Z, User(admin), Operation(Install Services), Status(COMPLETED), RequestId(7)
+2016-10-05T12:15:06.928Z, User(admin), Operation(INSTALL LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(7), TaskId(154), Hostname(c6402.ambari.apache.org)
+2016-10-05T12:15:11.172Z, User(admin), RemoteIp(192.168.64.1), Operation(STARTED: all services (myCluster)), RequestId(8), Status(Successfully queued)
+2016-10-05T12:15:11.180Z, User(admin), Operation(Start Added Services), Status(IN_PROGRESS), RequestId(8)
+2016-10-05T12:15:11.180Z, User(admin), Operation(START LOGSEARCH_SERVER), Status(QUEUED), RequestId(8), TaskId(157), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:15:20.953Z, User(admin), Operation(START LOGSEARCH_SERVER), Status(COMPLETED), RequestId(8), TaskId(157), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:15:21.328Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(8), TaskId(158), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:15:21.328Z, User(admin), Operation(SERVICE_CHECK LOGSEARCH_SERVICE_CHECK), Details(SERVICE_CHECK LOGSEARCH), Status(QUEUED), RequestId(8), TaskId(159), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:15:21.329Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(8), TaskId(160), Hostname(c6402.ambari.apache.org)
+2016-10-05T12:15:21.329Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(8), TaskId(161), Hostname(c6403.ambari.apache.org)
+2016-10-05T12:15:21.329Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(QUEUED), RequestId(8), TaskId(162), Hostname(c6404.ambari.apache.org)
+2016-10-05T12:15:22.968Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(8), TaskId(160), Hostname(c6402.ambari.apache.org)
+2016-10-05T12:15:23.025Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(8), TaskId(162), Hostname(c6404.ambari.apache.org)
+2016-10-05T12:15:26.941Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(8), TaskId(158), Hostname(c6401.ambari.apache.org)
+2016-10-05T12:15:48.950Z, User(admin), Operation(START LOGSEARCH_LOGFEEDER), Status(COMPLETED), RequestId(8), TaskId(161), Hostname(c6403.ambari.apache.org)
+2016-10-05T12:15:55.920Z, User(admin), Operation(Start Added Services), Status(COMPLETED), RequestId(8)
+2016-10-05T12:15:55.920Z, User(admin), Operation(SERVICE_CHECK LOGSEARCH_SERVICE_CHECK), Details(SERVICE_CHECK LOGSEARCH), Status(COMPLETED), RequestId(8), TaskId(159), Hostname(c6401.ambari.apache.org)
+2016-10-05T13:09:33.055Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-05T13:09:33.055Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-05T13:09:33.124Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-05T13:09:34.863Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-05T13:09:55.468Z, User(admin), RemoteIp(192.168.64.1), Operation(User login), Roles(
+    Ambari: Ambari Administrator
+), Status(Success)
+2016-10-06T07:44:56.131Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-06T07:44:56.219Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-06T07:44:56.326Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)
+2016-10-06T07:45:01.686Z, User(null), RemoteIp(192.168.64.1), Operation(User login), Roles(
+), Status(Failed), Reason(Authentication required)

ambari-server/src/main/resources/common-services/LOGSEARCH/0.5.0/package/templates/input.config-ambari.json.j2

@@ -271,6 +271,10 @@
       "value_borders":"()",
       "post_map_values":{
         "User":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
           "map_fieldname":{
             "new_fieldname":"reqUser"
           }
@@ -280,6 +284,11 @@
             "new_fieldname":"host"
           }
         },
+        "Host name":{
+          "map_fieldname":{
+            "new_fieldname":"host"
+          }
+        },
         "RemoteIp":{
           "map_fieldname":{
             "new_fieldname":"cliIP"
@@ -315,7 +324,112 @@
             "new_fieldname":"resource"
           }
         },
+        "Cluster name":{
+          "map_fieldname":{
+            "new_fieldname":"cluster"
+          }
+        },
+        "Reason":{
+          "map_fieldname":{
+            "new_fieldname":"reason"
+          }
+        },
+        "Base URL":{
+          "map_fieldname":{
+            "new_fieldname":"ws_base_url"
+          }
+        },
+        "Command":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_command"
+          }
+        },
+        "Component":{
+          "map_fieldname":{
+            "new_fieldname":"ws_component"
+          }
+        },
+        "Details":{
+          "map_fieldname":{
+            "new_fieldname":"ws_details"
+          }
+        },
+        "Display name":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_display_name"
+          }
+        },
+        "OS":{
+          "map_fieldname":{
+            "new_fieldname":"ws_os"
+          }
+        },
+        "Repo id":{
+          "map_fieldname":{
+            "new_fieldname":"ws_repo_id"
+          }
+        },
+        "Repo version":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_repo_version"
+          }
+        },
+        "Repositories":{
+          "map_fieldname":{
+            "new_fieldname":"ws_repositories"
+          }
+        },
+        "Roles":{
+          "map_fieldname":{
+            "new_fieldname":"ws_roles"
+          }
+        },
+        "Stack":{
+          "map_fieldname":{
+            "new_fieldname":"ws_stack"
+          }
+        },
+        "Stack version":{
+          "map_fieldname":{
+            "new_fieldname":"ws_stack_version"
+          }
+        },
+        "VersionNote":{
+          "map_fieldvalue":{
+            "pre_value":"null",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_version_note"
+          }
+        },
+        "VersionNumber":{
+          "map_fieldvalue":{
+            "pre_value":"Vnull",
+            "post_value":"unknown"
+          },
+          "map_fieldname":{
+            "new_fieldname":"ws_version_number"
+          }
+        },
         "Status":[
+          {
+            "map_fieldcopy":{
+              "copy_name": "ws_status"
+            }
+          },
           {
             "map_fieldvalue":{
               "pre_value":"Success",
@@ -413,6 +527,11 @@
           }
         ],
         "ResultStatus":[
+          {
+            "map_fieldcopy":{
+              "copy_name": "ws_result_status"
+            }
+          },
           {
             "map_fieldvalue":{
               "pre_value":"200 OK",

ambari-server/src/main/resources/common-services/LOGSEARCH/0.5.0/package/templates/input.config-falcon.json.j2

@@ -41,7 +41,7 @@
       "post_map_values":{
         "logtime":{
           "map_date":{
-            "target_target_date_pattern":"yyyy-MM-dd HH:mm:ss,SSS"
+            "target_date_pattern":"yyyy-MM-dd HH:mm:ss,SSS"
           }
 
         }