Skip to content

Instantly share code, notes, and snippets.

@frozenfoxx
Created October 11, 2013 20:43
Show Gist options
  • Save frozenfoxx/6941746 to your computer and use it in GitHub Desktop.
Save frozenfoxx/6941746 to your computer and use it in GitHub Desktop.
input {
file {
type => "syslog"
path => ["/var/log/secure", "/var/log/messages"]
tags => ["syslog"]
}
pipe {
type => "edgecast-logs"
command => "zcat /home/edgecast/logs/*.log.gz"
tags => ["cdn"]
}
}
filter {
grok {
type => "edgecast-logs"
pattern => "(?<timestamp>%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}) %{INT:timetaken} %{IPORHOST:clientip} %{INT:filesize} %{IPORHOST:sourceip} %{INT:sourceport} %{NOTSPACE:response} %{INT:bytes} %{WORD:verb} %{NOTSPACE:request} - %{INT:duration} %{INT:rsbytes} \"(?:%{NOTSPACE:referrer}|-)\" %{QUOTEDSTRING:agent} %{INT:customerid}"
}
}
@frozenfoxx
Copy link
Author

2013-10-10 19:45:21 0 75.134.171.2 8798 46.22.74.245 80 TCP_HIT/200 9025 GET http://versionec.us.somecompany.com/directory1/LatestBuild/Data/somefile.wad - 0 513 "-" "Company Patcher" 21017 "-"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment