Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
input {
stdin { }
}
filter {
grok {
match => {
message => "<\d+>%{TIMESTAMP_ISO8601:timestamp} [^:]+[:] %{IP:client} %{GREEDYDATA}GMT%{SPACE}%{WORD:method}%{SPACE}%{URIPATHPARAM:path}%{SPACE}%{NUMBER:httpStatus}%{SPACE}%{URI:referer}"
}
}
grok {
match => [
"path", "/gallery/%{GREEDYDATA:customer}/%{WORD:env}/%{GREEDYDATA}"
]
}
date {
locale => "en"
match => [ "timestamp", "ISO8601" ]
}
mutate {
convert => {
"httpStatus" => "integer"
}
remove_field => [
"syslog5424_pri",
"logsource",
"host",
"program",
"pid",
"timestamp8601"
]
}
}
#
# output {
# stdout {
# codec => json
# }
# }
#
output {
elasticsearch {
cluster => "elasticsearch.local"
host => "127.0.0.1"
protocol => http
index => "logstash-5"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment