Last active
August 12, 2018 14:41
-
-
Save milnomada/50459080985ee5adad21e1ec3cca6a12 to your computer and use it in GitHub Desktop.
Install logstash and show/install plugins
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Help | |
# https://www.elastic.co/guide/en/logstash/current/plugins-outputs-solr_http.html | |
# https://www.elastic.co/guide/en/logstash/current/plugins-inputs-syslog.html | |
printf "Installing logstrash.." | |
name=logstash-6.3.2 | |
pkg="$name.tar.gz" | |
wget "https://artifacts.elastic.co/downloads/logstash/$pkg" | |
tar -xvzf $pkg | |
cd $name | |
bin//logstash-plugin list | |
printf "Installing plugins [solr_http,syslog]" | |
bin/logstash-plugin install logstash-output-solr_http | |
printf "[solr_http] OK" | |
bin/logstash-plugin install logstash-input-syslog | |
printf "[syslog] OK" | |
# Parse uwsgi logs in syslog | |
grok_pattern_simple= "%{SYSLOGTIMESTAMP} %{DATA:messagetype} %{DATA:hostname} %{HOSTNAME:ip} %{DATA:text} %{DATA:text} \[%{DATA:date}\] %{GREEDYDATA:request_data}" | |
grok_pattern='%{SYSLOGTIMESTAMP} %{DATA:messagetype} %{DATA:hostname} %{HOSTNAME:ip} %{DATA:text} %{DATA:text} \[%{DATA:date}\] \\\"%{DATA:http_method} %{DATA:request_url} %{DATA:http_version}\\\" %{DATA:http_code} %{DATA:response_sz} \\\"\-\\\"\ \\\"%{GREEDYDATA:user_agent}\\' | |
grok_pattern_filtered="%{SYSLOGTIMESTAMP} %{DATA:messagetype} %{DATA:hostname}\: %{HOSTNAME:ip} %{DATA:text} %{DATA:text} \[%{DATA:date}\] %{DATA:http_method} %{DATA:request_url} %{DATA:http_version} %{DATA:http_code} %{DATA:response_payload} %{DATA:http_referer} %{GREEDYDATA:user_agent}" | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment