Skip to content

Instantly share code, notes, and snippets.

View untergeek's full-sized avatar

Aaron Mildenstein untergeek

83 followers · 0 following
View GitHub Profile
@untergeek
untergeek / h.conf
Last active February 20, 2017 12:54
Logstash Debugging #1
input {
# file {
# path => ["C:/logs/Proj/*/*.log"]
# start_position => beginning
# }
stdin { }
}
@untergeek
untergeek / curator_windows_executable.md
Last active October 30, 2017 10:23
Build a Windows binary for Curator with Nuitka

Curator Binary Creation (Windows Edition)

Prerequisites

Please install in this order.

Install Python

  • Download 2.7.9 (64-bit)
  • Install with these options:
    • Install for all users
    • Customize Python 2.7.9:
      • Select Add python.exe to Path
@untergeek
untergeek / elasticsearch-template.json
Created August 7, 2014 18:25
My current logstash/elasticsearch-index template
{
"template" : "logstash-*",
"settings" : {
"number_of_shards" : 5,
"index.refresh_interval" : "5s"
},
"mappings" : {
"_default_" : {
"_all" : {"enabled" : true},
"dynamic_templates" : [ {
@untergeek
untergeek / logstash.excerpt
Last active August 29, 2015 14:05
apache pruning
if [type] == "apache_json" {
geoip { source => "clientip" }
if [useragent] != "" { useragent { source => "useragent" } }
if [auth] == "-" { mutate { remove_field => "auth" } }
if [ident] == "-" { mutate { remove_field => "ident" } }
if [referer] == "-" { mutate { remove_field => "referer" } }
}
@untergeek
untergeek / crontab
Created July 22, 2014 14:43
curator script info
30 2 * * * ~/bin/curator.sh &> /dev/null
@untergeek
untergeek / collectd-logstash.conf
Created July 21, 2014 17:30
conditional output
output {
stdout { debug => true debug_format => "json"}
if [type] == 'collectd' {
elasticsearch {
cluster => "elasticsearch"
}
}
}
@untergeek
untergeek / b.conf
Last active August 29, 2015 14:04
Grok debug
input { stdin {} }
filter {
grok {
match => [ "message", "\[%{RUBY_LOGLEVEL:loglevel}\] %{TIMESTAMP_ISO8601:logdate} %{ISO8601_TIMEZONE:timezone} \[%{NOTSPACE:somefield}\] \[%{IP:ipaddress}\] %{GREEDYDATA:therest}" ]
}
mutate {
gsub => [ "logdate", "\ ", "T" ]
replace => { "logdate" => "%{logdate}%{timezone}" }
}
date {
@untergeek
untergeek / logstash.conf
Created July 17, 2014 20:59
grok rule oddity...
input {
stdin {
type => "weblogic-server"
}
}
filter {
### weblogic-server
if [type] == "weblogic-server" {
multiline {
@untergeek
untergeek / a.txt
Created July 15, 2014 23:14
Curator with python strftime datestamp support
buh@BigMini (06:12 PM) [~/GIT/curator/curator] $ curl -XPUT 'http://localhost:9200/logstash-20140710/'
{"acknowledged":true}
@untergeek
untergeek / command-line.help
Last active August 29, 2015 14:02
$ python test.py --help
usage: test.py [-h] [-v] [--host HOST] [--url_prefix URL_PREFIX] [--port PORT]
[--ssl] [-t TIMEOUT] [-n] [-D] [--loglevel LOG_LEVEL]
[-l LOG_FILE]
{allocation,bloom,close,delete,optimize,show_indices,snapshot}
...
Curator for Elasticsearch indices. See
http://github.com/elasticsearch/curator/wiki