Created
October 18, 2018 09:09
-
-
Save peteralfafara/dc159ef23910a5c6c7aa3ef606914ae8 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| input { | |
| tcp { port => 5514 } | |
| } | |
| filter { | |
| json { source => "message" } | |
| if [check][status] == "0" { | |
| mutate { | |
| add_tag => "state-ok" | |
| } | |
| } | |
| else if [check][status] == "1" { | |
| mutate { | |
| add_tag => "state-warning" | |
| } | |
| } | |
| else if [check][status] == "2" { | |
| mutate { | |
| add_tag => "state-critical" | |
| } | |
| } | |
| mutate { | |
| gsub => ["[check][name]","_GOTMDEV","", | |
| "[check][name]","_GOTMMLE",""] | |
| add_field => { | |
| "name" => "%{[check][name]}" | |
| "clientName" => "%{[client][name]}" | |
| "clientAddress" => "%{[client][address]}" | |
| "checkCommand" => "%{[check][command]}" | |
| "checkDuration" => "%{[check][duration]}" | |
| "checkInterval" => "%{[check][interval]}" | |
| "checkPayloadType" => "%{[check][payload-type]}" | |
| "checkStatus" => "%{[check][status]}" | |
| } | |
| } | |
| if [check][name] == "keepalive" { | |
| mutate { | |
| add_field => { | |
| "checkHandler" => "%{[check][handler]}" | |
| "checkOutput" => "%{[check][output]}" | |
| "checkThresholsdCritical" => "%{[check][thresholds][critical]}" | |
| "checkThresholsdWarning" => "%{[check][thresholds][warning]}" | |
| "checkTotalStateChange" => "%{[check][total_state_change]}" | |
| "checkType" => "%{[check][type]}" | |
| "clientKeepaliveHandler" => "%{[client][keepalive][handler]}" | |
| "clientKeepaliveThresholsdCritical" => "%{[client][keepalive][thresholds][critical]}" | |
| "clientKeepaliveThresholsdWarning" => "%{[client][keepalive][thresholds][warning]}" | |
| "clientVersion" => "%{[client][version]}" | |
| } | |
| } | |
| mutate { | |
| remove_field => ["[check][executed]", | |
| "[check][handler]", | |
| "[check][history]", | |
| "[check][issued]", | |
| "[check][name]", | |
| "[check][output]", | |
| "[check][threshold][critical]", | |
| "[check][threshold][warning]", | |
| "[check][total_state_change]", | |
| "[check][type]", | |
| "checkCommand", | |
| "checkDuration", | |
| "checkInterval", | |
| "checkPayloadType", | |
| "[client][address]", | |
| "[client][keepalive][handler]", | |
| "[client][keepalive][threshold][critical]", | |
| "[client][keepalive][threshold][warning]", | |
| "[client][name]", | |
| "[client][subscription]", | |
| "[client][timestamp]", | |
| "message", | |
| "occurrences", | |
| "occurrences_watermark", | |
| "last_ok"] | |
| } | |
| } | |
| if [check][payload-type] == "json" { | |
| mutate { | |
| add_tag => "payload-json" | |
| gsub => ["[check][output]","}\n{","},{"] | |
| replace => {"[check][output]" => "[%{[check][output]}]"} | |
| gsub => ["[name]","json-",""] | |
| } | |
| json { source => "[check][output]" | |
| target => "data"} | |
| split { field => "data" } | |
| mutate { | |
| remove_field => ["[check][output]", | |
| "[check][name]", | |
| "[check][command]", | |
| "[check][duration]", | |
| "[check][interval]", | |
| "[check][payload-type]", | |
| "[check][status]", | |
| "occurrences", | |
| "silenced", | |
| "[check][handler]", | |
| "[check][subscribers]", | |
| "[check][standalone]", | |
| "[check][total_state_change]", | |
| "[check][executed]", | |
| "[check][history]", | |
| "[check][type]", | |
| "[check][issued]", | |
| "message", | |
| "occurrences_watermark", | |
| "last_ok", | |
| "@version", | |
| "[client][subscriptions]", | |
| "client", | |
| "action", | |
| "id", | |
| "timestamp", | |
| "silenced_by"] | |
| } | |
| } | |
| else if [check][payload-type] == "event-queues-xml" { | |
| if !("split-xml" in [tags]) { | |
| mutate { | |
| add_tag => "split-xml" | |
| } | |
| json { source => "[check][output]" | |
| target => "data"} | |
| split { field => "data" } | |
| } | |
| if [data][EventQueuesPerf][App] { | |
| if ("split-xml" in [tags]) { | |
| split{field => "data[EventQueuesPerf][App]"} | |
| split{field => "data[EventQueuesPerf][App][EventQueues][EventQueue]"} | |
| split{field => "data[EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread]"} | |
| } | |
| } | |
| else { | |
| split{field => "data[EventQueuesPerf][EventQueues][EventQueue]"} | |
| split{field => "data[EventQueuesPerf][EventQueues][EventQueue][Threads][Thread]"} | |
| } | |
| mutate { | |
| remove_field => ["[check][output]", | |
| "[check][name]", | |
| "[check][command]", | |
| "[check][duration]", | |
| "[check][interval]", | |
| "[check][payload-type]", | |
| "[check][status]", | |
| "occurrences", | |
| "silenced", | |
| "[check][handler]", | |
| "[check][subscribers]", | |
| "[check][standalone]", | |
| "[check][total_state_change]", | |
| "[check][executed]", | |
| "[check][history]", | |
| "[check][type]", | |
| "[check][issued]", | |
| "message", | |
| "occurrences_watermark", | |
| "last_ok", | |
| "@version", | |
| "[client][subscriptions]", | |
| "client", | |
| "action", | |
| "id", | |
| "timestamp", | |
| "silenced_by"] | |
| } | |
| } | |
| else if [check][payload-type] == "app-cache-perf-xml" { | |
| if !("split-xml" in [tags]) { | |
| mutate { | |
| add_tag => "split-xml" | |
| } | |
| json { source => "[check][output]" | |
| target => "data"} | |
| split { field => "data" } | |
| } | |
| if [data][OTMCachesPerf][App] { | |
| if ("split-xml" in [tags]) { | |
| split{field => "data[OTMCachesPerf][App]"} | |
| split{field => "data[OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance]"} | |
| } | |
| } | |
| else { | |
| split{field => "data[OTMCachesPerf][OTMCachePerformances][OTMCachePerformance]"} | |
| } | |
| mutate { | |
| remove_field => ["[check][output]", | |
| "[check][name]", | |
| "[check][command]", | |
| "[check][duration]", | |
| "[check][interval]", | |
| "[check][payload-type]", | |
| "[check][status]", | |
| "occurrences", | |
| "silenced", | |
| "[check][handler]", | |
| "[check][subscribers]", | |
| "[check][standalone]", | |
| "[check][total_state_change]", | |
| "[check][executed]", | |
| "[check][history]", | |
| "[check][type]", | |
| "[check][issued]", | |
| "message", | |
| "occurrences_watermark", | |
| "last_ok", | |
| "@version", | |
| "[client][subscriptions]", | |
| "client", | |
| "action", | |
| "id", | |
| "timestamp", | |
| "silenced_by"] | |
| } | |
| } | |
| else if [check][payload-type] == "web-cache-perf-xml" { | |
| if !("split-xml" in [tags]) { | |
| mutate { | |
| add_tag => "split-xml" | |
| } | |
| json { source => "[check][output]" | |
| target => "data"} | |
| split { field => "data" } | |
| } | |
| if [data][OTMCachesPerf][Web] { | |
| if ("split-xml" in [tags]) { | |
| split{field => "data[OTMCachesPerf][Web]"} | |
| split{field => "data[OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance]"} | |
| } | |
| } | |
| else { | |
| split{field => "data[OTMCachesPerf][OTMCachePerformances][OTMCachePerformance]"} | |
| } | |
| mutate { | |
| remove_field => ["[check][output]", | |
| "[check][name]", | |
| "[check][command]", | |
| "[check][duration]", | |
| "[check][interval]", | |
| "[check][payload-type]", | |
| "[check][status]", | |
| "occurrences", | |
| "silenced", | |
| "[check][handler]", | |
| "[check][subscribers]", | |
| "[check][standalone]", | |
| "[check][total_state_change]", | |
| "[check][executed]", | |
| "[check][history]", | |
| "[check][type]", | |
| "[check][issued]", | |
| "message", | |
| "occurrences_watermark", | |
| "last_ok", | |
| "@version", | |
| "[client][subscriptions]", | |
| "client", | |
| "action", | |
| "id", | |
| "timestamp", | |
| "silenced_by"] | |
| } | |
| } | |
| if [name] == "stale-transmission" { | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][I_TRANSMISSION_NO]}" | |
| } | |
| } | |
| } | |
| else if [name] == "agent-tracking-feed" { | |
| date { | |
| match => ["[data][INSERT_DATE]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][INSERT_DATE]" | |
| } | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][TRACKING_FEED_ID]}" | |
| } | |
| } | |
| } | |
| else if [name] == "object-locks" { | |
| date { | |
| match => ["[data][OWNED_SINCE]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][OWNED_SINCE]" | |
| } | |
| date { | |
| match => ["[data][INSERT_DATE]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][INSERT_DATE]" | |
| } | |
| date { | |
| match => ["[data][UPDATE_DATE]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][UPDATE_DATE]" | |
| } | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][LOCK_TYPE]}-%{[data][OBJECT_ID]}" | |
| } | |
| } | |
| } | |
| else if [name] == "uncommitted-dml" { | |
| date { | |
| match => ["[data][START_TIME]","MM/dd/yy HH:mm:ss"] | |
| target => "[data][START_TIME]" | |
| } | |
| mutate { | |
| convert => { | |
| "[data][NUM_OF_DB_LOCKS]" => "integer" | |
| "[data][NUM_OF_TRANSACTIONS]" => "integer" | |
| } | |
| add_field => { | |
| "v_document_id" => "%{[data][SID]}" | |
| } | |
| } | |
| } | |
| else if [name] == "database-locks" { | |
| date { | |
| match => ["[data][START_TIME]","MM/dd/yy HH:mm:ss"] | |
| target => "[data][START_TIME]" | |
| } | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][BLOCKER_SID]}-%{[data][BLOCKEE_SID]}-%{[data][OBJECT_ID]}" | |
| } | |
| } | |
| } | |
| else if [name] == "event-queues" { | |
| if ![data][EventQueuesPerf][App] { | |
| mutate { | |
| add_field => { "[data][EventQueuesPerf][App][id]" => "App Server" } | |
| rename => { | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][id]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][id]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][Backlog]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][Backlog]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][LongestEvent]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][LongestEvent]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][ProcessTime][Average]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Average]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][ProcessTime][Count]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Count]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][ProcessTime][Maximum]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Maximum]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][ProcessTime][Total]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Total]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][QueueSize][Average]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Average]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][QueueSize][Count]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Count]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][QueueSize][Maximum]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Maximum]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][QueueSize][Total]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Total]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][Threads][Thread][Since]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][Since]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][Threads][Thread][State]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][State]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][Threads][Thread][id]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][id]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][Throughput]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][Throughput]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][WaitTime][Average]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Average]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][WaitTime][Count]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Count]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][WaitTime][Maximum]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Maximum]" | |
| "[data][EventQueuesPerf][EventQueues][EventQueue][WaitTime][Total]" => "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Total]" | |
| "[data][EventQueuesPerf][LastResetTime]" => "[data][EventQueuesPerf][App][LastResetTime]" } | |
| } | |
| } | |
| mutate { | |
| convert => { | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][Backlog]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Average]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Count]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Maximum]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][ProcessTime][Total]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Average]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Count]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Maximum]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][QueueSize][Total]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][Throughput]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Average]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Count]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Maximum]" => "float" | |
| "[data][EventQueuesPerf][App][EventQueues][EventQueue][WaitTime][Total]" => "float" | |
| } | |
| } | |
| date { | |
| match => ["[data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][Since]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][Since]" | |
| } | |
| date { | |
| match => ["[data][EventQueuesPerf][App][LastResetTime]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][EventQueuesPerf][App][LastResetTime]" | |
| } | |
| date { | |
| match => ["[data][time]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][time]" | |
| } | |
| if ![data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][id] { | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][time]}-%{[data][EventQueuesPerf][App][id]}-%{[data][EventQueuesPerf][App][EventQueues][EventQueue][id]}" | |
| } | |
| } | |
| } | |
| else { | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][time]}-%{[data][EventQueuesPerf][App][id]}-%{[data][EventQueuesPerf][App][EventQueues][EventQueue][id]}-%{[data][EventQueuesPerf][App][EventQueues][EventQueue][Threads][Thread][id]}" | |
| } | |
| } | |
| } | |
| } | |
| else if [name] == "bulk-plan" { | |
| date { | |
| match => ["[data][START_TIME]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][START_TIME]" | |
| } | |
| date { | |
| match => ["[data][END_TIME]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][END_TIME]" | |
| } | |
| date { | |
| match => ["[data][TERMINATION_TIME]","yyyy-MM-dd HH:mm:ss ZZ"] | |
| target => "[data][TERMINATION_TIME]" | |
| } | |
| mutate { | |
| convert => { | |
| "[data][NUM_OF_ORDERS_SELECTED]" => "integer" | |
| "[data][NUM_ORDER_MOVEMENTS_SELECTED]" => "integer" | |
| } | |
| add_field => { | |
| "v_document_id" => "%{[data][DOMAIN_NAME]}.%{[data][BULK_PLAN_XID]}" | |
| } | |
| } | |
| } | |
| else if [name] == "app-cache-performance" { | |
| if ![data][OTMCachesPerf][App] { | |
| mutate { | |
| add_field => { "[data][OTMCachesPerf][App][id]" => "App Server" } | |
| rename => { | |
| "[data][OTMCachesPerf][LastResetTime]" => "[data][OTMCachesPerf][App][LastResetTime]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Capacity]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Capacity]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Gets]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Gets]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][HitRatio]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][HitRatio]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Logging]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Logging]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Puts]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Puts]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Size]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Size]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][SwapRatio]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][SwapRatio]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Synch]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Synch]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Timeout]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Timeout]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Type]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Type]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][id]" => "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][id]" | |
| } | |
| } | |
| } | |
| mutate { | |
| convert => { | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Capacity]" => "float" | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Gets]" => "float" | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][HitRatio]" => "float" | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Puts]" => "float" | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Size]" => "float" | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][SwapRatio]" => "float" | |
| "[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][Timeout]" => "float" | |
| } | |
| } | |
| date { | |
| match => ["[data][OTMCachesPerf][App][LastResetTime]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][OTMCachesPerf][App][LastResetTime]" | |
| } | |
| date { | |
| match => ["[data][time]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][time]" | |
| } | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][time]}-%{[data][OTMCachesPerf][App][id]}-%{[data][OTMCachesPerf][App][OTMCachePerformances][OTMCachePerformance][id]}" | |
| } | |
| } | |
| } | |
| else if [name] == "web-cache-performance" { | |
| if ![data][OTMCachesPerf][Web] { | |
| mutate { | |
| add_field => { "[data][OTMCachesPerf][Web][id]" => "Web Server" } | |
| rename => { | |
| "[data][OTMCachesPerf][LastResetTime]" => "[data][OTMCachesPerf][Web][LastResetTime]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Capacity]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Capacity]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Gets]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Gets]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][HitRatio]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][HitRatio]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Logging]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Logging]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Puts]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Puts]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Size]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Size]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][SwapRatio]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][SwapRatio]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Synch]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Synch]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Timeout]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Timeout]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][Type]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Type]" | |
| "[data][OTMCachesPerf][OTMCachePerformances][OTMCachePerformance][id]" => "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][id]" | |
| } | |
| } | |
| } | |
| mutate { | |
| convert => { | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Capacity]" => "float" | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Gets]" => "float" | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][HitRatio]" => "float" | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Puts]" => "float" | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Size]" => "float" | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][SwapRatio]" => "float" | |
| "[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][Timeout]" => "float" | |
| } | |
| } | |
| date { | |
| match => ["[data][OTMCachesPerf][Web][LastResetTime]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][OTMCachesPerf][Web][LastResetTime]" | |
| } | |
| date { | |
| match => ["[data][time]","yyyy-MM-dd HH:mm:ss ZZZ"] | |
| target => "[data][time]" | |
| } | |
| mutate { | |
| add_field => { | |
| "v_document_id" => "%{[data][time]}-%{[data][OTMCachesPerf][Web][id]}-%{[data][OTMCachesPerf][Web][OTMCachePerformances][OTMCachePerformance][id]}" | |
| } | |
| } | |
| } | |
| else { | |
| fingerprint { | |
| source => ["message"] | |
| target => "v_document_id" | |
| key => "78787878" | |
| method => "SHA1" | |
| concatenate_sources => true | |
| } | |
| } | |
| if "_jsonparsefailure" in [tags] { | |
| drop { } | |
| } | |
| } | |
| output { | |
| elasticsearch { | |
| hosts => "******.com" | |
| user => "elastic" | |
| password => "changeme" | |
| index => "%{[name]}-%{+YYYY.MM.dd}" | |
| document_id => "%{[v_document_id]}" | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment