Skip to content

Instantly share code, notes, and snippets.

@Synchro
Last active March 18, 2016 16:59
Show Gist options
  • Save Synchro/5917252 to your computer and use it in GitHub Desktop.
Save Synchro/5917252 to your computer and use it in GitHub Desktop.
Logstash config for parsing drupal watchdog log entries. Greps the syslog_program source first to check it's logged by drupal, then takes apart the watchdog log pattern. See: https://api.drupal.org/api/drupal/modules!syslog!syslog.module/function/syslog_watchdog/7
grep {
type => "syslog"
match => [ "syslog_program", "drupal" ]
add_tag => "Drupal"
drop => false
}
grok {
type => "syslog"
tags => [ "Drupal" ]
match => [ "@message", "^https?://%{HOSTNAME:drupal_vhost}\|%{NUMBER:drupal_timestamp}\|(?<drupal_action>[^\|]*)\|%{IP:drupal_ip}\|(?<drupal_request_uri>[^\|]*)\|(?<drupal_referer>[^\|]*)\|(?<drupal_uid>[^\|]*)\|(?<drupal_link>[^\|]*)\|(?<drupal_message>.*)" ]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment