Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Opscode Chef logstash cookbook - filters.json - WIP
"filters": [
{
"grok": {
"type": "syslog",
"pattern": [
"<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:[%{POSINT:syslog_pid}])?: %{GREEDY$
],
"add_field": {
"received_from",
"%{@source_host}"
}
}
},
{
"syslog_pri": {
"type": "syslog"
}
},
{
"date": {
"type": "syslog",
"syslog_timestamp": [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss"
]
}
},
{
"mutate": {
"type": "syslog",
"exclude_tags": "_grokparsefailure",
"replace": [
"@message",
"%{syslog_message}"
]
}
},
{
"mutate": {
"type": "syslog",
"remove": [
"syslog_hostname",
"syslog_message",
"syslog_timestamp"
]
}
}
]
},
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.