gistfile1.txt

node.default['mongodb']['logstash_server_role'] = "logstash_allinone"
logstash_server = search(:node, "role:#{node['mongodb']['logstash_server_role']} AND chef_environment:#{node.chef_environment}").first

unless logstash_server.nil?
  node.set['logstash']['patterns'] = {
      "mongodb" => {
        "WORDDASH" => '\b[\w-]+\b',
        "MONGODB" => '%{SYSLOGTIMESTAMP:timestamp} \[%{WORD:component}\] %{GREEDYDATA:message}',
        "SLOW_QUERY" => 'query %{WORDDASH:database}\.%{WORDDASH:collection} %{NOTSPACE}: \{ (?<query>(.*)(?<=(} )))%{WORD}:%{NONNEGINT:ntoreturn} %{WORD}:%{NONNEGINT:ntoskip} %{WORD}:%{NONNEGINT:nscanned} %{NOTSPACE:what}..*(?<duration>(?<= )[0-9]+)ms'
      }
  }

  node.set['logstash']['agent'] = {
    "inputs" => [
      {
        "file" => {
          "path" => [ "/var/log/mongodb/mongodb.log*" ],
          "type" => "mongodb"
        }
      }
    ],
    "filters" => [
      {
        "condition" => "if [type] == 'mongodb'",
        "block" => {
          "grok" => {
            "match" => [ 'message', '%{MONGODB}' ],
            "overwrite" => [ "message" ],
            "add_tag" => [ 'grokked' ]
          },
          "date" => {
            "match" => [ "timestamp", "MMM  d HH:mm:ss.SSS", "MMM dd HH:mm:ss.SSS" ],
            "add_tag" => [ "dated" ],
          },
        },
      },
      {
        "condition" => "if [type] == 'mongodb' and 'grokked' in [tags] and [message] and [message] =~ /(connection accepted|end connection|log line attempted)/",
        "block" => {
          "drop" => { }
        }
      },
      {
        "condition" => "else if [type] == 'mongodb' and 'grokked' in [tags] and [message] and message =~ /^query/",
        "block" => {
          "grok" => {
            "match" => [ 'message', '%{SLOW_QUERY}' ],
            "add_tag" => [ "slow_query" ]
          }
        }
      },
      {
        "condition" => "if [type] == 'mongodb' and 'dated' in [tags]",
        "block" => {
          "mutate" => {
            "remove_field" => [ "timestamp" ],
            "remove_tag" => [ "dated" ]
          }
        }
      }
    ],
    "outputs" => [
      {
        "redis" => {
          "host" => logstash_server['ipaddress'],
          "data_type" => "channel",
          "key" => "logstash"
        }
      }
    ]
  }

  include_recipe "java"
  include_recipe "logstash::agent"

end