Skip to content

Instantly share code, notes, and snippets.

@PeterGarlic
PeterGarlic / RFC-pattern
Last active July 17, 2018 07:04
/etc/logstash/pattern.d/RFC-pattern
### ref: https://github.com/logstash-plugins/logstash-input-syslog/issues/15#issuecomment-355655279
# This is a flexable grok pattern file for syslog. By default, it attempts to be
# relaxed and accomodate implimentation variations.
# valid priority range from 0 to 191, but 00 or 001 technically not legitimate
# according to RFC 3164.
SYSLOGPRINUMSTRICT (?:0|(?:(?:[1-9][0-9])|(?:1[0-8][0-9])|(?:19[0-1])))
# the example below is less precise but hopefully faster. Rather use range
# checking logic in conf.
@PeterGarlic
PeterGarlic / 01-collect-rsyslog.conf
Last active July 17, 2018 07:04
/etc/logstash/conf.d/01-collect-rsyslog.conf
### ref: https://github.com/logstash-plugins/logstash-input-syslog/issues/15#issuecomment-355655279
input {
tcp {
mode => "server"
host => "192.168.56.10"
port => "5514"
type => "syslog"
}
udp {