Skip to content

Instantly share code, notes, and snippets.

@milnomada
Last active August 12, 2018 14:41
Show Gist options
  • Save milnomada/50459080985ee5adad21e1ec3cca6a12 to your computer and use it in GitHub Desktop.
Save milnomada/50459080985ee5adad21e1ec3cca6a12 to your computer and use it in GitHub Desktop.
Install logstash and show/install plugins
# Help
# https://www.elastic.co/guide/en/logstash/current/plugins-outputs-solr_http.html
# https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html
printf "Installing logstrash.."
name=logstash-6.3.2
pkg="$name.tar.gz"
wget "https://artifacts.elastic.co/downloads/logstash/$pkg"
tar -xvzf $pkg
cd $name
bin//logstash-plugin list
printf "Installing plugins [solr_http,syslog]"
bin/logstash-plugin install logstash-output-solr_http
printf "[solr_http] OK"
bin/logstash-plugin install logstash-input-syslog
printf "[syslog] OK"
# Parse uwsgi logs in syslog
grok_pattern_simple= "%{SYSLOGTIMESTAMP} %{DATA:messagetype} %{DATA:hostname} %{HOSTNAME:ip} %{DATA:text} %{DATA:text} \[%{DATA:date}\] %{GREEDYDATA:request_data}"
grok_pattern='%{SYSLOGTIMESTAMP} %{DATA:messagetype} %{DATA:hostname} %{HOSTNAME:ip} %{DATA:text} %{DATA:text} \[%{DATA:date}\] \\\"%{DATA:http_method} %{DATA:request_url} %{DATA:http_version}\\\" %{DATA:http_code} %{DATA:response_sz} \\\"\-\\\"\ \\\"%{GREEDYDATA:user_agent}\\'
grok_pattern_filtered="%{SYSLOGTIMESTAMP} %{DATA:messagetype} %{DATA:hostname}\: %{HOSTNAME:ip} %{DATA:text} %{DATA:text} \[%{DATA:date}\] %{DATA:http_method} %{DATA:request_url} %{DATA:http_version} %{DATA:http_code} %{DATA:response_payload} %{DATA:http_referer} %{GREEDYDATA:user_agent}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment