Skip to content

Instantly share code, notes, and snippets.

@tbragin
Created July 22, 2015 13:34
Show Gist options
  • Save tbragin/eec3d30e962af9a61074 to your computer and use it in GitHub Desktop.
Save tbragin/eec3d30e962af9a61074 to your computer and use it in GitHub Desktop.
Logstash version tested: 1.5.0
input {
stdin { }
}
filter {
grok {
match => {
"message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'
}
}
date {
match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
locale => en
}
geoip {
source => "clientip"
}
useragent {
source => "agent"
target => "useragent"
}
}
output {
stdout { codec => dots }
elasticsearch {
host => "localhost"
protocol => "http"
cluster => "elasticsearch"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment