Logstash filters

10-apache-filter.conf

filter {
  if [type] == "apache_access" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
    date {
      match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
  }
}

filter {
  if [type] == "apache_error" {
    grok {
        match => { "message" => "\[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}\] \[:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}\]( \(%{POSINT:proxy_errorcode}\)%{DATA:proxy_errormessage}:)?( \[client %{IPORHOST:client}:%{POSINT:clientport}\])? PHP %{DATA:php_error_level}: %{DATA:php_error} in %{DATA:php_file} on line %{POSINT:php_line}" }
    }
    grok {
        match => { "message" => "\[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}\] \[:%{LOGLEVEL:loglevel}\] \[pid %{POSINT:pid}\]( \(%{POSINT:proxy_errorcode}\)%{DATA:proxy_errormessage}:)?( \[client %{IPORHOST:client}:%{POSINT:clientport}\])? %{GREEDYDATA:message}" }
    }
  }
}

10-symfony-filter.conf

filter {
  if [format] == "symfony" {
    grok {
      match => {
        "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:context}\.%{LOGLEVEL:level}:"
      }
    }
    date {
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss"]
      timezone => "America/Argentina/Buenos_Aires"
    }
  }
}

10-toba-filter.conf

filter {
  if [format] == "toba" {
    grok {
      match => {
        "message" => [
          "Fecha: (?<fecha>%{DATE_EU} %{TIME})",
          "Operacion: (?<operacion>[^\r\n]*)",
          "Usuario: (?<usuario>[^\r\n]*)",
          "Host: %{IP:host}",
          "Servidor: (?<servidor>[^\r\n]*)",
          "Version-PHP: (?<php>[^\r\n]*)",
          "URI: (?<uri>[^\r\n]*)",
          "==========[\r\n]%{GREEDYDATA:message}"
        ]
      }
      overwrite => [ "message" ]
      break_on_match => false
    }
    date {
      match => ["fecha", "dd-MM-yyyy HH:mm:ss"]
      timezone => "America/Argentina/Buenos_Aires"
    }
  }
}