In the interest of providing guidance to our users and ensuring that those who find the Force Relinquish command actually understand the ramifications of using it, is it possible to expose this as a discoverable command from the journal file? Or if this is already possible, can someone guide me 
@eric.stimmel would you be able to share the file that contains the ForceRelinquishCommand logs? That would be helpful for me to analyze the issue and see if we can make some changes to our parsers that would pick it up.
Sure - I’ll email it to you.
@eric.stimmel so I had a look at this, and was able to make a few changes to our Filebeat and Logstash parse routines to start picking up that particular command. I will have these changes reviewed and tested, but we should be able to include them in the next release.
Now, if you are interested in perhaps testing these locally on your end, you could update your Filebeat with the following settings:
#=========================== Revit Inputs =====================================
- type: log
enabled: true
paths:
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2017\Journals\journal.*.txt
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2018\Journals\journal.*.txt
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2019\Journals\journal.*.txt
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2020\Journals\journal.*.txt
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2021\Journals\journal.*.txt
tags: [revitlog, revitlog_2021]
multiline.pattern: '(^.*\b(API_ERROR)\b.*$)|[EH]\s\d\d-\w{3}-\d{4}\s|(^.*\b(Rvt.Attr.ForceRelinquishCommand)\b.*$)'
multiline.negate: true
multiline.match: after
multiline.max_lines: 4
- type: log
enabled: true
paths:
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2022\Journals\journal.*.txt
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2023\Journals\journal.*.txt
- C:\Users\*\AppData\Local\Autodesk\Revit\Autodesk Revit 2024\Journals\journal.*.txt
tags: [revitlog, revitlog_2022]
multiline.pattern: '(^.*\b(API_ERROR)\b.*$)|[EH]\s\d\d-\w{3}-\d{4}\s|(^.*\b(Rvt.Attr.ForceRelinquishCommand)\b.*$)'
multiline.negate: true
multiline.match: after
multiline.max_lines: 4
After that you will need a few changes to the Logstash.config as well:
if [logdate] {
date {
locale => "en-US"
match => ["logdate","dd-MMM-yyyy' 'HH:mm:ss.SSS"]
target => "logdate"
}
}
if [message] =~ "^(?=.*Rvt.Attr.ForceRelinquishCommand).*" {
mutate {
add_field => {"Action" => "Clicked Confirm force relinquish"}
add_field => {"logdate" => "%{@timestamp}"}
remove_tag => ["_grokparsefailure"]
}
}
This allows me to pick up that command and I can see it in Kibana:
1 Like