apache-error-log.conf

axa-error-log.conf

input {
    file {
        path => [ "/diskZ/elklog/axa/ssm*/error_log*" ]
        start_position => beginning
        type => "axa-apache-error"
        sincedb_path => "/dev/null"
        ignore_older => 0
    }
}

filter {
  if [type] == "axa-apache-error" {
    grok {
     match => { "message" => "\[%{DAY} (?<timestamp>%{MONTH} %{MONTHDAY} %{TIME} %{YEAR})\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IP:clientip}\] ){0,1}%{GREEDYDATA:errormsg}" }
    }

    date {
       match => [ "timestamp" , "MMM dd HH:mm:ss YYYY" ]
    }

    geoip {
       source => "clientip"
    }
  }
}

output {
  if [type] == "axa-apache-error" {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "logstash-axa-errorlog-%{+YYYY.MM.dd}"
    }
  #stdout { codec => rubydebug }
  }
}