Skip to content

Instantly share code, notes, and snippets.

@jordansissel
Created February 20, 2011 02:51
Show Gist options
  • Save jordansissel/835639 to your computer and use it in GitHub Desktop.
Save jordansissel/835639 to your computer and use it in GitHub Desktop.
logstash config?
input {
file {
path => [ "/var/log/messages", "/var/log/kern.log" ]
type => "linux-syslog"
}
file {
path => "/var/log/apache2/access.log"
type => "apache-access"
}
file {
path => "/var/log/apache2/error.log"
type => "apache-error"
}
}
output {
amqp {
host => "myamqpserver"
exchange_type => "fanout"
name => "rawlogs"
}
amqp {
host => "127.0.0.1"
exchange_type => "topic"
name => "logsniff"
}
stdout { }
}
# Filters are applied in the order the appear.
filter {
multiline {
type => "supervisorlogs"
pattern => "^\s"
what => previous
}
multiline {
type => "testing"
pattern => "^\s"
what => previous
}
grok {
type => "linux-syslog"
pattern => ["%{SYSLOG_SUDO}", "%{SYSLOG_KERNEL}", "%{SYSLOGLINE}" ]
}
grok {
type => "nagios"
pattern => "%{NAGIOSLOGLINE}"
}
#date {
#" testing" => fizzle
#}
}
% bin/logstash -f etc/agent.lgtm.conf
Comment: Filters are applied in the order the appear.
Comment: date {
Comment: " testing" => fizzle
Comment: }
LogStash::Inputs::Base: Sharing config 'type' with subclass LogStash::Inputs::File
LogStash::Inputs::Base: Sharing config 'tag' with subclass LogStash::Inputs::File
I, [2011-02-20T03:57:42.277000 #4434] INFO -- logstash: config LogStash::Inputs::File/@path = ["/var/log/messages", "/var/log/kern.log"]
I, [2011-02-20T03:57:42.285000 #4434] INFO -- logstash: config LogStash::Inputs::File/@type = "linux-syslog"
I, [2011-02-20T03:57:42.289000 #4434] INFO -- logstash: config LogStash::Inputs::File/@path = ["/var/log/apache2/access.log"]
I, [2011-02-20T03:57:42.290000 #4434] INFO -- logstash: config LogStash::Inputs::File/@type = "apache-access"
I, [2011-02-20T03:57:42.294000 #4434] INFO -- logstash: config LogStash::Inputs::File/@path = ["/var/log/apache2/error.log"]
I, [2011-02-20T03:57:42.295000 #4434] INFO -- logstash: config LogStash::Inputs::File/@type = "apache-error"
I, [2011-02-20T03:57:43.030000 #4434] INFO -- logstash: config LogStash::Outputs::Amqp/@host = "myamqpserver"
I, [2011-02-20T03:57:43.033000 #4434] INFO -- logstash: config LogStash::Outputs::Amqp/@exchange_type = "fanout"
I, [2011-02-20T03:57:43.035000 #4434] INFO -- logstash: config LogStash::Outputs::Amqp/@name = "rawlogs"
{"fanout"=>["fanout", "queue", "topic"]}
I, [2011-02-20T03:57:43.041000 #4434] INFO -- logstash: config LogStash::Outputs::Amqp/@host = "127.0.0.1"
I, [2011-02-20T03:57:43.042000 #4434] INFO -- logstash: config LogStash::Outputs::Amqp/@exchange_type = "topic"
I, [2011-02-20T03:57:43.043000 #4434] INFO -- logstash: config LogStash::Outputs::Amqp/@name = "logsniff"
{"topic"=>["fanout", "queue", "topic"]}
LogStash::Filters::Base: Sharing config 'type' with subclass LogStash::Filters::Multiline
I, [2011-02-20T03:57:43.067000 #4434] INFO -- logstash: config LogStash::Filters::Multiline/@type = "supervisorlogs"
I, [2011-02-20T03:57:43.069000 #4434] INFO -- logstash: config LogStash::Filters::Multiline/@pattern = "^\\s"
I, [2011-02-20T03:57:43.070000 #4434] INFO -- logstash: config LogStash::Filters::Multiline/@what = "previous"
I, [2011-02-20T03:57:43.073000 #4434] INFO -- logstash: config LogStash::Filters::Multiline/@type = "testing"
I, [2011-02-20T03:57:43.074000 #4434] INFO -- logstash: config LogStash::Filters::Multiline/@pattern = "^\\s"
I, [2011-02-20T03:57:43.075000 #4434] INFO -- logstash: config LogStash::Filters::Multiline/@what = "previous"
LogStash::Filters::Base: Sharing config 'type' with subclass LogStash::Filters::Grok
I, [2011-02-20T03:57:43.438000 #4434] INFO -- logstash: config LogStash::Filters::Grok/@type = "linux-syslog"
I, [2011-02-20T03:57:43.439000 #4434] INFO -- logstash: config LogStash::Filters::Grok/@pattern = ["%{SYSLOG_SUDO}", "%{SYSLOG_KERNEL}", "%{SYSLOGLINE}"]
I, [2011-02-20T03:57:43.442000 #4434] INFO -- logstash: config LogStash::Filters::Grok/@type = "nagios"
I, [2011-02-20T03:57:43.443000 #4434] INFO -- logstash: config LogStash::Filters::Grok/@pattern = ["%{NAGIOSLOGLINE}"]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment