Skip to content

Instantly share code, notes, and snippets.

@jjungnickel
Forked from pblittle/logstash_linked.conf
Last active August 29, 2015 14:11
Show Gist options
  • Save jjungnickel/0ccdb71d85fb43b6a4e4 to your computer and use it in GitHub Desktop.
Save jjungnickel/0ccdb71d85fb43b6a4e4 to your computer and use it in GitHub Desktop.
input {
udp {
port => 5140
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch_http {
host => "ES_HOST"
port => "ES_PORT"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment