hekad.toml

[hekad]
maxprocs = 2

[secure]
type = "LogstreamerInput"
log_directory = "/var/log"
file_match = 'secure'
decoder = "RsyslogDecoder"

[messages]
type = "LogstreamerInput"
log_directory = "/var/log"
file_match = 'messages'
decoder = "RsyslogDecoder"

[cron]
type = "LogstreamerInput"
log_directory = "/var/log"
file_match = 'cron'
decoder = "RsyslogDecoder"

[PayloadEncoder]
append_newlines = false

#[LogOutput]
#message_matcher = "TRUE"
#encoder = "PayloadEncoder"

[stat_graph]
type = "SandboxFilter"
filename = "lua_filters/stat_graph.lua"
ticker_interval = 1
preserve_data = true
message_matcher = "Type == 'heka.statmetric'"

	[stat_graph.config]
	num_rows = 300
	secs_per_row = 1
	stats = "stats.counters.000000.count stats.counters.000001.count stats.counters.000002.count"
	stat_labels = "counter_0 counter_1 counter_2"
	preservation_version = 0

[DashboardOutput]
ticker_interval = 1

[ESJsonEncoder]
index = "%{Type}-%{2006.01.02}"
es_index_from_timestamp = true
type_name = "%{Type}"

[ElasticSearchOutput]
message_matcher = "TRUE"
encoder = "ESJsonEncoder"
flush_interval = 50

[TcpInput-syslog]
type = "TcpInput"
address = ":5565"
decoder = "RsyslogDecoder"
splitter = "NullSplitter"

[TcpInput-ibm-httpserver-access]
type = "TcpInput"
address = ":5566"
decoder = "ApacheRegexDecoder"
splitter = "NullSplitter"
send_decode_failures = true

[RsyslogDecoder]
type = "SandboxDecoder"
filename = "lua_decoders/rsyslog.lua"

	[RsyslogDecoder.config]
	type = "rsyslog_traditionaltimeformat"
	template = '%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n'
	tz = "America/Chicago"

[IbmHttpserverAccessCommonLogDecoder]
type = "SandboxDecoder"
filename = "lua_decoders/apache_access.lua"
	
	[IbmHttpserverAccessCommonLogDecoder.config]
	type = "ibm-httpserver-access-common"
	log_format = '%h %l %u %t \"%r\" %>s %O'

[ApacheRegexDecoder]
type = "PayloadRegexDecoder"
match_regex = '^(?P<AllDaContentz>.*)'

	[ApacheRegexDecoder.message_fields]
	Type = "TestingApache"
	Logger = "testingApache"
        Message = "%AllDaContentz%"