Skip to content

Instantly share code, notes, and snippets.

@megastef
Forked from Leen15/patterns.yml
Last active October 18, 2016 11:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save megastef/2921aaa500315f39d779496902b18f9a to your computer and use it in GitHub Desktop.
Save megastef/2921aaa500315f39d779496902b18f9a to your computer and use it in GitHub Desktop.
Patterns for sematext agent
patterns:
- sourceName: !!js/regexp /docker-nginx-loadbalancer/
match:
- type: nginxbalancer
regex: !!js/regexp /^(\[(.+?)\]\s-\sclient_ip=(.+?)\slb=(.+?)\scontainer=(.+?)\sresponse_status=(.+?)\spath="(.+?)"\sresponse=(.+?)\scontainer_status=(.+?)\stotal_time=(.+?)\sbytes=(.+?)\suser_agent="(.+?)"\shost=(.+?)\sbody=(.+)$)/i
fields:
- message
- ts
- client_ip:string
- lb:string
- container:string
- response_status:number
- path:string
- response_time:number
- container_status:number
- total_time:number
- bytes:number
- user_agent:string
- host_name:string
- body:string
dateFormat: DD/MMM/YYYY:HH:mm:ss ZZ
# drop messages with the text "debug"
inputDrop: !!js/regexp /debug/i
- sourceName: !!js/regexp /uala-backend/
match:
- type: backend
regex: !!js/regexp /method=(.+?)\spath=(\S+)\sformat=(\S+)\scontroller=(.+?)\saction=(.+?)\sstatus=\d+\sduration=(.+?)\sview=(.+?)\sdb=(.+?)$/i
fields:
- method:string
- path2:string
- format:string
- controller:string
- action:string
- status:number
- duration:number
- view:number
- db:number
dateFormat: DD/MMM/YYYY:HH:mm:ss ZZ
# drop messages with the text "debug"
inputDrop: !!js/regexp /debug/i
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment