Skip to content

Instantly share code, notes, and snippets.

@mchesler
Created January 2, 2018 21:00
Show Gist options
  • Save mchesler/2a49e8a10eae740f898b675acc56f7c7 to your computer and use it in GitHub Desktop.
Save mchesler/2a49e8a10eae740f898b675acc56f7c7 to your computer and use it in GitHub Desktop.
input {
beats {
port => "5043"
}
}
filter {
if [tag] == "syslog" {
grok {
match => { "message" => "%{SYSLOGBASE} %{GREEDYDATA:message}" }
overwrite => [ "message" ]
}
} else if [tag] == "postgres" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{TZ} (\[?)%{USER:user}(\]?)%{DATA}(\[?)%{WORD:database}(\]?) %{IP:host}\(%{INT:pid}\)%{WORD:level}: %{GREEDYDATA:message}" }
overwrite => [ "message" ]
}
}
mutate {
add_field => { "datacenter" => "dc1" }
}
}
output {
amazon_es {
hosts => ["hosted.url.es.amazonaws.com"]
region => "us-east-1"
manage_template => "false"
index => "logs-%{+YYYY.MM.dd}"
flush_size => "7500"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment