Skip to content

Instantly share code, notes, and snippets.

filter {
if "apache_access_json" in [tags] {
if [useragent] != "-" and [useragent] != "" {
useragent {
add_tag => [ "UA" ]
source => "useragent"
prefix => "UA-"
}
}
output {
elasticsearch {
host => "localhost"
protocol => "http"
}
}
@hacktvist
hacktvist / gist:8e1b50dbb85a156ff6d8
Created January 7, 2015 12:32
logstash input file
input {
lumberjack {
port => 5000
tags => ["apache_access_json"]
codec => "json"
ssl_certificate => "/etc/ssl/logstash.pub"
ssl_key => "/etc/ssl/logstash.key"
}
}