Skip to content

Instantly share code, notes, and snippets.

@lumue
Last active September 26, 2015 12:54
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lumue/4d21b34cb0f890250ccb to your computer and use it in GitHub Desktop.
Save lumue/4d21b34cb0f890250ccb to your computer and use it in GitHub Desktop.
a better logstash syslog input - inspired by http://kartar.net/2014/09/when-logstash-and-syslog-go-wrong/
input {
tcp {
port => 514
type => syslog
}
udp {
port => 514
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
}
}
}
output {
if [type] == "syslog" and "_grokparsefailure" in [tags] {
file { path => "/var/log/failed_syslog_events-%{+YYYY-MM-dd}" }
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment