Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
logstash.conf + syslog parse
input {
tcp {
port => 5000
type => syslog
}
udp {
port => 5000
type => syslog
}
}
## Add your filters / logstash plugins configuration here
filter {
if [type] == "syslog" {
grok {
match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{PO
SINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
}
}
}
output {
if [type] == "syslog" and "_grokparsefailure" in [tags] {
file { path => "/var/log/failed_syslog_events-%{+YYYY-MM-dd}" }
}
elasticsearch {
hosts => "elasticsearch:9200"
}
}
@mister2d

This comment has been minimized.

Copy link

@mister2d mister2d commented Aug 14, 2017

What text editor created this file? It has white space and line breaks all over the place.

Please sanitize this file and re-upload it. It is unusable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment