Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Logstash 2.1.x config for log4net logs.
input {
file {
path => ".../Logs/*.log"
type => "log4net"
sincedb_path => ".../since.db"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} "
negate => true
what => previous
}
# start_position => "beginning" - does not work with the codec in logstash 2.1
}
}
filter {
grok {
match => ["path", "(?<filename>[^/]+?)(-\[(?<processid>\d+)\])?\.log" ]
add_field => [ "process", "%{host}:%{processid}" ]
}
if [type] == "log4net" {
grok {
match => ["message", "%{TIMESTAMP_ISO8601:timestamp} \[%{NUMBER:threadid}\] %{WORD:level}\s*%{DATA:class} %{DATA:NDC} - %{GREEDYDATA:message}"]
overwrite => ["message","timestamp"]
}
date {
match => ["timestamp","yyyy-MM-dd HH:mm:ss,SSS"]
remove_field => ["timestamp"]
}
grok {
match => [ "message", "(?<message>[^\r\n]*)\r?(\n(?<exception>.*))?"]
overwrite => ["message"]
}
}
kv {
trim => "\r\(\)"
trimkey => "\r\(\)"
source => "message"
# target => "props"
value_split => ":"
allow_duplicate_values => false
}
mutate {
convert => {
"processid" => "integer"
"threadid" => "integer"
"Elapsed" => "integer"
"ItemId" => "integer"
}
}
}
output {
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
template_overwrite => true
}
stdout { codec => rubydebug }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.