logstash-syslog

logstash-syslog

輔大 syslog.conf:
input {              
	udp {
    port => 514
		type => syslog
		}
	stdin{
		type => stdin
	}
}
filter {
	
				
			
        grok {
				match => { "message" => '%{SYSLOGTIMESTAMP} %{IPV4:iphost} date=%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{GREEDYDATA:fgtlogmsg}'
                }
                match => { "message" => '<%{NONNEGINT:syslog_pri}>%{GREEDYDATA:fgtlogmsg}'
                }
        }
		if [type] == "syslog" {
        kv {
                source => "fgtlogmsg"
				remove_field => [ "fgtlogmsg" ]
				add_field => {
				"Log_Type" => "syslog"
				}
			}
				
        }
		if [type] == "stdin" {
        kv {
                source => "fgtlogmsg"
				remove_field => [ "fgtlogmsg" ]
				
				add_field => {
				"Log_Type" => "stdin"
				}
			}
				
        }
		mutate {
			rename => { "srcip" => "IPV4_SRC_ADDR" }
			rename => { "dstip" => "IPV4_DST_ADDR" }
			rename => { "proto" => "PROTOCOL" }
			rename => { "eventtime" => "LAST_SWITCHED" }
			
			
		}
		
		syslog_pri { }
		if "_grokparsefailure" in [tags] {
		drop { }
		}
	
}
output {

	elasticsearch { hosts => ["140.136.200.179:9200"] }
	stdout { codec => rubydebug }
}