peteralfafara

[2018-10-18T08:03:39,976][DEBUG][logstash.filters.json    ] Event after json filter {:event=>#<LogStash::Event:0x5d471e5a>}
[2018-10-18T08:03:39,974][DEBUG][logstash.filters.json    ] Event after json filter {:event=>#<LogStash::Event:0x7e006a3>}
[2018-10-18T08:03:39,992][DEBUG][logstash.filters.json    ] Running json filter {:event=>#<LogStash::Event:0x3a50ec23>}
[2018-10-18T08:03:39,977][DEBUG][logstash.filters.json    ] Event after json filter {:event=>#<LogStash::Event:0x4c52bb40>}
[2018-10-18T08:03:39,977][DEBUG][logstash.pipeline        ] filter received {"event"=>{"@timestamp"=>2018-10-18T06:03:39.863Z, "@version"=>"1", "message"=>"{\"client\":{\"name\":\"EMEA_PPT_APP\",\"address\":\"czcholspc000543.prg-dc.dhl.com\",\"subscriptions\":[\"ALL\",\"client:EMEA_PPT_APP\"],\"keepalive\":{\"thresholds\":{\"warning\":3600,\"critical\":7200}},\"version\":\"1.2.0\",\"timestamp\":1539842601},\"check\":{\"thresholds\":{\"warning\":3600,\"critical\":7200},\"name\":\"keepalive\",\"issued\":1539842619,\"executed\":15

peteralfafara

input {
tcp { port => 5514 }
}
filter {
 json { source => "message" }
 if [check][status] == "0" {
   mutate {
     add_tag => "state-ok"
   }
 }