Skip to content

Instantly share code, notes, and snippets.

@jordansissel
Created July 25, 2014 13:40
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jordansissel/1a86444970ce9831654d to your computer and use it in GitHub Desktop.
Save jordansissel/1a86444970ce9831654d to your computer and use it in GitHub Desktop.
input { stdin { } }
filter {
grok {
match => { "message" => "<%{NUMBER:syslog_pri}>%{DATA:message}$" }
overwrite => "message"
}
syslog_pri {
remove_field => "syslog_pri"
}
kv { }
}
output {
stdout {
codec => rubydebug
}
}
% bin/logstash -f logstash.conf
<134>id=firewall sn=xxxxxxxxx time="2014-07-25 09:21:55" fw=x.x.x.x pri=6 c=262144 m=98 msg="Connection Opened" n=534006506 src=x.x.x.x:1828:X1 dst=x.x.x.x:80:X1 proto=tcp/http
{
"message" => "id=firewall sn=xxxxxxxxx time=\"2014-07-25 09:21:55\" fw=x.x.x.x pri=6 c=262144 m=98 msg=\"Connection Opened\" n=534006506 src=x.x.x.x:1828:X1 dst=x.x.x.x:80:X1 proto=tcp/http",
"@version" => "1",
"@timestamp" => "2014-07-25T13:39:21.826Z",
"type" => "stdin",
"host" => "oh-my",
"syslog_severity_code" => 6,
"syslog_facility_code" => 16,
"syslog_facility" => "local0",
"syslog_severity" => "informational",
"id" => "firewall",
"sn" => "xxxxxxxxx",
"time" => "2014-07-25 09:21:55",
"fw" => "x.x.x.x",
"pri" => "6",
"c" => "262144",
"m" => "98",
"msg" => "Connection Opened",
"n" => "534006506",
"src" => "x.x.x.x:1828:X1",
"dst" => "x.x.x.x:80:X1",
"proto" => "tcp/http"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment