Skip to content

Instantly share code, notes, and snippets.

@chernjie
Created March 19, 2015 04:59
Show Gist options
  • Save chernjie/c3fef17fee15e534463d to your computer and use it in GitHub Desktop.
Save chernjie/c3fef17fee15e534463d to your computer and use it in GitHub Desktop.
Logstash multiline filter for Magento
filter {
if [type] == "magento" {
multiline{
pattern => "^%{TIMESTAMP_ISO8601:timestamp}"
what => "previous"
negate=> true
}
grok {
match => [
"message",
"(?m)%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:priority_name} \(%{INT:priority_level}\): %{GREEDYDATA:message}"
]
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
overwrite => [ "message" ]
}
date {
match => [ "timestamp", "ISO8601" ]
}
json {
source => "message"
target => "json"
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment