Skip to content

Instantly share code, notes, and snippets.

@jrwren
Created April 30, 2015 18:35
Show Gist options
  • Save jrwren/ee14e6f6454d877fc322 to your computer and use it in GitHub Desktop.
Save jrwren/ee14e6f6454d877fc322 to your computer and use it in GitHub Desktop.
logstash anonymize filter
input {
file {
path => "/home/jrwren/src/logstash-1.4.2/access.log"
start_position => beginning
}
}
filter {
if [path] =~ "access" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}%{GREEDYDATA:message_remainder}" }
}
anonymize {
# algorithm => "IPV4_NETWORK"
key => "16"
fields => ["proxyip", "clientip"]
}
if [message_remainder] {
mutate {
replace => {
"message" => "%{message_remainder}"
"type" => "apache_access"
}
}
} else {
mutate {
replace => {
"type" => "apache_access"
"message" => ""
}
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
}
output { stdout {
codec => rubydebug
} }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment