apache logstash

gistfile1.txt

input {
  file {
    path => [ "/mnt/weblogs/*access.log" ]
    type => "apache-access"
    sincedb_path => "/opt/logstash/sincedb-access"
  }
  file {
    path => [ "/mnt/weblogs/*error.log" ]
    type => "apache-error"
    sincedb_path => "/opt/logstash/sincedb-error"
  }
}


filter {
  if [type] == "apache-access" {

  grok {
      match =>
    {
    "message" => "%{COMBINEDAPACHELOG}"
                singles  => true
    }
  }

  if [agent] {
    useragent {
      source => "agent"
    }
  }


  if [clientip]
      {
      geoip
    {
    source => "clientip"
    target => "geoip"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
      mutate
    {
    convert => [ "[geoip][coordinates]", "float" ]
    }
      }
  }

    if [type] == "apache-error"
  {
  grok
      {
      patterns_dir => [ "/etc/logstash/patterns" ]
      match =>
    [
    "message", "%{MODSECAPACHEERROR}",
    "message", "%{GENERICAPACHEERROR}"
    ]
      }
  if [agent] {
    useragent {
      source => "agent"
    }
  }
  if [sourcehost]
      {
      geoip
    {
    source => "sourcehost"
    target => "geoip"
    add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
    add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
    }
      mutate
    {
    convert => [ "[geoip][coordinates]", "float" ]
    }
      }
  }
}