Skip to content

Instantly share code, notes, and snippets.

@mohit
Created August 11, 2013 22:42
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save mohit/6207215 to your computer and use it in GitHub Desktop.
Save mohit/6207215 to your computer and use it in GitHub Desktop.
Parse MongoDB logs in logstash
filters {
grok {
type => "mongodb"
pattern => [ "%{DATA:mongo_ts} \[%{DATA:mongo_conn}\]? %{DATA:mongo_type} %{GREEDYDATA:mongo_message}" ]
}
mutate {
type => "mongodb"
replace => [ "@message", "%{mongo_message}" ]
}
grok {
type => "mongodb"
match => [ "mongodb_conn", "query|command|getmore" ] # list of mongo commands with k:v pairs
pattern => [ "%{DATA:mongo_collection} %{GREEDYDATA:mongo_details} %{NUMBER:mongo_time:int}ms" ]
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment