Job Log Forwarding - Ironstream_Hub - ironstream_for_elastic - ironstream_for_kafka - ironstream_for_splunk - 1.3

Ironstream Hub Administration

Product type
Product family
Ironstream > Ironstream for Elastic®
Ironstream > Ironstream Hub
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream for Splunk®
Product name
Ironstream Hub
Ironstream Hub Administration
First publish date

You can filter messages from IBM i job logs and forward them to your chosen targets. To do that, Hub must receive the Job End message (CPF1164) at first, then request collection of the associated job log from the agent. You can choose the jobs from which you wish to collect the logs and the messages from these logs by LPAR using the Configuration Tool.

These are the prerequisites that are needed before job logs can be collected and forwarded to a chosen target:
  • The jog logs must be going to the system QEZJOBLOG in the QUSRSYS Library.
  • QHST must be collected from the LPAR.
  • The CPF1164 message must be included in the QHST message filter list.
  • Any changes to the QHST collection need to be distributed to the LPARs.
  • Any changes to the Job Log Forwarding Filters need to be distributed to the LPARs.

See above for details on how to configure the QHST collection.

Once Hub receives a CPF1164 message for a job that is listed in a Job Log Forwarding filter associated with an LPAR, it will request the log from the agent, giving it these parameters:
  • Job Name
  • Job ID
  • Job User

The agent sends records that meet the message filtering constraints to Hub, which processes the raw records, creates JSON formatted records, and sends them to the Target.

From the Job Log Forwarding configuration panel, click the Create button to create a new Job Log Forwarding filter or click the Edit button to edit an existing filter.

When defining a filter, enter the values for these fields:
Table 1. Fields of a Job Log Forwarding Filter definition
Field Description Notes
Job Name Specify the filter that will define one or more jobs whose job logs you want to collect. The restrictions are as follows:
  • The text must be limited to 10 characters.
  • The text defined in this field must be unique in defined list of Job Log Forwarding Filters.
  • The text can only begin with one of these characters: A letter, or any of these: $ # @ (dollar, hash/pound or ‘at’ )
  • The text can be a mix of these characters: Letters, numbers or any of these: $ # @ . _ (dollar, hash/pound, ‘at’ , period or underscore)
Comment Enter any additional information that can be useful for future review.  
Assigned systems Assign the systems that you require this filter to be applied.  

You can use the Add Filter button to filter the message IDs to be forwarded from the job log. Use the Delete button to remove message IDs from the filter.

The restrictions are as follows:

  • It must be limited to 7 alphanumeric characters.
  • Up to two wildcard characters are allowed.
Note: A period (.) indicates that any single character in that position should be considered a match.

See these examples:

Messages Required Filters
All messages *
ABC1234 ABC1234
All messages beginning with 'ABC' ABC*
Any 7-character message beginning with 'ABC' and ending with '9' ABC...9