[LOGSTASH 101] Logstash 101 #logstash #linux #debian

LOGSTASH-101.md

LOGSTASH 101

• Debug pipeline:

input {
  pipeline {
    address => apache2
  }
}

filter {

  grok {
    match => { "message" => '\*\*(?<response_time>[^/]+)%{DATA:after_double_star}\*\*' }
  }

   grok {
       match => [
           "message" , "%{COMBINEDAPACHELOG}"
       ]
   }
  if [response_time] {
    mutate {
      convert => { "response_time" => "integer" }
    }
  }
}

output {
    elasticsearch {
        hosts => [ 'localhost:9200' ]
        index => "apache2-%{+YYYY-MM-dd}"
    }
  if [host][hostname] == 'xxxxxx-xxxxxx' {
    file {
      path => "/tmp/debug.log"
      codec => rubydebug
    }
  }
}