Skip to content

Instantly share code, notes, and snippets.

@fetep
fetep / 00-logstash.conf
Created December 31, 2011 06:54
Logstash JSON filter
input {
file {
type => syslog
path => "/var/log/messages"
}
}
filter {
grok {
type => syslog
@fetep
fetep / 00-log4j.diff
Created January 2, 2012 22:46
logstash + log4j configuration!
diff --git a/lib/logstash/logging.rb b/lib/logstash/logging.rb
index bafb342..b0692e2 100644
--- a/lib/logstash/logging.rb
+++ b/lib/logstash/logging.rb
@@ -3,6 +3,8 @@ require "cabin"
require "logger"
class LogStash::Logger < Cabin::Channel
+ attr_accessor :target
+
logstash config:
input {
stdin {
type => "syslog"
}
}
filter {
grok {
@fetep
fetep / 00-config
Created January 8, 2012 00:21
logstash event modifiers
input {
stdin {
type => "test"
}
}
filter {
mutate {
add_field => [
"regexp_test", "%{@message:s/foo/bar}",
#!/usr/bin/ruby
require "socket"
1000.times do |n|
puts "opening socket ##{n}"
TCPSocket.new("client4.scl2.svc.mozilla.com", 4444)
end
$stdin.read
@fetep
fetep / config
Created March 6, 2012 14:45
sample logstash config for rails log line
input {
stdin {
type => rails
}
}
filter {
grok {
type => "rails"
pattern => "Completed %{GREEDYDATA:operation} in %{NUMBER:time:int}ms"
@fetep
fetep / input line
Created March 8, 2012 15:12
grok lockup reproduce-by
10.14.205.18 load-sync20.services.mozilla.com cuser291808 [06/Mar/2012:16:52:07 -0800] "GET /1.0/cuser291808/info/collections HTTP/1.1" 503 222 "-" "RPT-HTTPClient/0.3-3E" "-" "ssl: SSL_RSA_WITH_RC4_128_SHA, version=TLSv1, bits=128" node_s:- req_s:0.041069 retries:0 req_b:218 "c_l:-"
@fetep
fetep / genhttplogs.rb
Created March 14, 2012 15:32
apache log generator
#!/usr/bin/ruby
class IPGenerator
public
def initialize(session_count, session_length)
@session_count = session_count
@session_length = session_length
@sessions = {}
end
@fetep
fetep / gist:2579375
Created May 2, 2012 19:10
conditional @source_host replacement
input {
stdin {
format => "json"
type => "test"
}
}
filter {
grep {
type => "test"
@fetep
fetep / 00-config
Created June 25, 2012 03:37
logstash - multiple filter workers
input {
stdin {
type => "zeus"
}
}
filter {
grok {
type => "zeus"
pattern => "%{IP:ip} %{HOST:host} %{USER:user} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) \"(?:%{URI:referrer}|-)\" %{QS:agent} \"%{GREEDYDATA:cookie}\" %{QS:ssl} node_s:(?:%{NUMBER:node_time}|-) req_s:(?:%{NUMBER:req_time}|-) retries:(?:%{NUMBER:retries}|-)"