Skip to content

Instantly share code, notes, and snippets.

@jalogisch

jalogisch/ghost_pipeline_extract_messages

Created August 1, 2016 10:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jalogisch/caaa26021e89c58aee8b7d6d0eaf9ce5 to your computer and use it in GitHub Desktop.
Save jalogisch/caaa26021e89c58aee8b7d6d0eaf9ce5 to your computer and use it in GitHub Desktop.
Download ZIP
this is the pipeline rule to get the information of ghost blog log that is started/monitored by systemd into useful fields in graylog
Raw
ghost_pipeline_extract_messages
rule "extract_ghost_blog_from_systemd_log"
when
has_field("programname") AND to_string($message.programname) == "Ghost"
then
let message_field = to_string($message.message);
let action = grok(pattern: "%{COMBINEDAPACHELOG}", value: message_field);
set_fields(action);
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment