Skip to content

Instantly share code, notes, and snippets.

@iDemonix
Created January 8, 2015 10:08
Show Gist options
  • Save iDemonix/4e2a910e49a4190837de to your computer and use it in GitHub Desktop.
Save iDemonix/4e2a910e49a4190837de to your computer and use it in GitHub Desktop.
Logstash Qpage Filter
filter {
if [type] == "qpage" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:qpage_date}\|%{HOSTNAME:server}\|%{WORD:pager_service}\|%{WORD:alert_type}\|\[RT# %{INT:rt}\] - %{WORD:problem_state}\|%{USERNAME:alert_host}\|%{WORD:alert_state}\|%{DATA:alert_result}\|%{GREEDYDATA:alert_check}" }
}
date {
match => ["qpage_date", "YYYY-MM-dd HH:mm:ss"]
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment