Skip to content

Instantly share code, notes, and snippets.

@dboyd13
Created April 7, 2017 07:18
Show Gist options
  • Save dboyd13/8e45c6e3b95ea48fd5097b1425f793e7 to your computer and use it in GitHub Desktop.
Save dboyd13/8e45c6e3b95ea48fd5097b1425f793e7 to your computer and use it in GitHub Desktop.
logstash.conf + syslog parse
input {
tcp {
port => 5000
type => syslog
}
udp {
port => 5000
type => syslog
}
}
## Add your filters / logstash plugins configuration here
filter {
if [type] == "syslog" {
grok {
match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{PO
SINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
}
}
}
output {
if [type] == "syslog" and "_grokparsefailure" in [tags] {
file { path => "/var/log/failed_syslog_events-%{+YYYY-MM-dd}" }
}
elasticsearch {
hosts => "elasticsearch:9200"
}
}
@mister2d
Copy link

What text editor created this file? It has white space and line breaks all over the place.

Please sanitize this file and re-upload it. It is unusable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment