Logstash config for parsing drupal watchdog log entries. Greps the syslog_program source first to check it's logged by drupal, then takes apart the watchdog log pattern. See: https://api.drupal.org/api/drupal/modules!syslog!syslog.module/function/syslog_watchdog/7

gistfile1.txt

  grep {
    type => "syslog"
    match => [ "syslog_program", "drupal" ]
    add_tag => "Drupal"
    drop => false
  }
  grok {
    type => "syslog"
    tags => [ "Drupal" ]
    match => [ "@message", "^https?://%{HOSTNAME:drupal_vhost}\|%{NUMBER:drupal_timestamp}\|(?<drupal_action>[^\|]*)\|%{IP:drupal_ip}\|(?<drupal_request_uri>[^\|]*)\|(?<drupal_referer>[^\|]*)\|(?<drupal_uid>[^\|]*)\|(?<drupal_link>[^\|]*)\|(?<drupal_message>.*)" ]
  }