Skip to content

Instantly share code, notes, and snippets.

@iamhowardtheduck
Last active September 19, 2019 02:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save iamhowardtheduck/977d55ecd64c460844381de531781896 to your computer and use it in GitHub Desktop.
Save iamhowardtheduck/977d55ecd64c460844381de531781896 to your computer and use it in GitHub Desktop.
Simply add your desired output section and save it as a *.conf file. Then run this command: curl http://stream.meetup.com/2/rsvps | /usr/share/logstash/bin/logstash -f wherever_you_saved_it_as.conf
input {
stdin {
codec => json_lines
}
}
filter {
mutate {
uppercase => [ "[group][group_country]" ]
replace => { "location" => "%{[group][group_lat]},%{[group][group_lon]}" }
}
date {
match => [ "mtime", "UNIX_MS" ]
target => "@timestamp"}
if [venue][lat] {
mutate {
replace => { "[venue][location]" => "%{[venue][lat]},%{[venue][lon]}" } }
}
json { source => "group.group_topics.topic_name" }
if [member][other_services][facebook][identifier] =~ /https:\/\/www.facebook.com\/http%3A%2F%2Fwww.facebook.com%2F.*/ {
grok { match => [ "member.other_services.facebook.identifier", "(?<member.other_services.facebook.identifier>(?:https://www.facebook.com/http%3A%2F%2Fwww.facebook.com%2F)(.*))" ] }
}
else if [member][other_services][facebook][identifier] =~ /https:\/\/www.facebook.com\/app_scoped_user_id\/.*/ {
grok { match => [ "member.other_services.facebook.identifier", "(?<member.other_services.facebook.identifier>(?:https://www.facebook.com/app_scoped_user_id/)(.*[^\/]))" ] }
}
else if [member][other_services][facebook][identifier] =~ /https.*/ {
grok { match => [ "member.other_services.facebook.identifier", "(?<member.other_services.facebook.identifier>(\d+)[^\/$])" ] }
}
}
@iamhowardtheduck
Copy link
Author

Simply add your desired output section and save it as a *.conf file. Then run this command:

curl http://stream.meetup.com/2/rsvps | /usr/share/logstash/bin/logstash -f wherever you saved it as.conf

@iamhowardtheduck
Copy link
Author

Update additional Facebook parsing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment