Skip to content

Instantly share code, notes, and snippets.

@fastjack
Created October 11, 2016 08:13
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save fastjack/86c4151ad3b27b402c72ff3b4c54c3e9 to your computer and use it in GitHub Desktop.
Save fastjack/86c4151ad3b27b402c72ff3b4c54c3e9 to your computer and use it in GitHub Desktop.
Logstash configuration for my irssi logs
input {
file {
type => "irssi_logs"
path => "/home/fastjack/irclogs/*/*/*.log"
start_position => "beginning"
}
}
filter {
if [type] == "irssi_logs" {
grok {
match => { "message" => "(?<timestamp>%{TIMESTAMP_ISO8601})[\<]*[@+* ]%{SPACE}*(?<nick>[^> ]*)[\>]+%{SPACE}(?<text>.*)" }
}
grok {
match => { "path" => "\A/home/fastjack/irclogs/(?<network>%{WORD})/(?<irc_channel>[#+]*[^\/]+)/.*\.log" }
}
if "_grokparsefailure" in [tags] {
drop {}
}
date {
match => [ "timestamp", "YYYY-MM-dd HH:mm:ss" ]
target => "@timestamp"
}
mutate {
remove_field => [ "timestamp" ]
}
}
}
output {
# Emit events to stdout for easy debugging of what is going through
# logstash.
# stdout { codec => rubydebug }
# This will use elasticsearch to store your logs.
elasticsearch { hosts => [ "localhost:9200" ] }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment