hekad configuration

elb.toml

[hekad]
base_dir = "/usr/local/var/cache/hekad"
decoder_poolsize = 10
max_message_loops = 4
max_process_inject = 10
max_timer_inject  = 10
maxprocs = 10
plugin_chansize = 10
poolsize = 100

[elb_raw_access_logs]
type = "LogstreamerInput"
log_directory = "elb-logs/AWSLogs"
file_match = '(?P<ELBID>[^/]+)/elasticloadbalancing/(?P<AWSRegion>[^/]+)/(?P<Year>\d+)/(?P<Month>\d+)/(?P<Day>\d+)/(?P<ELBFileID>[^ ]*)_elasticloadbalancing_(?P<AWSFileRegion>[^ ]*)_(?P<ELBName>[^ ]*)_(?P<ELBFileTS>[^ ]*)_(?P<ELBIP>[^ ]*)_(?P<ELBkey>[^ ]*).log'
priority = ["Year", "Month", "ELBFileTS"]

[elbtransformdecoder]
type = "PayloadRegexDecoder"
match_regex = '^(?P<Timestamp>[^ ]*) (?P<ELBName>[^ ]*) (?P<RequestIP>[^ ]*):(?P<RequestPort>[0-9]*) (?P<BackendIP>[^ ]*):(?P<BackendPort>[0-9]*) (?P<RequestProcessingTime>[.0-9]*) (?P<BackendProcessingTime>[.0-9]*) (?P<ClientResponseTime>[.0-9]*) (?P<ELBResponseCode>-|[0-9]*) (?P<BackendResponseCode>-|[0-9]*) (?P<ReceivedBytes>[-0-9]*) (?P<SentBytes>[-0-9]*) "(?P<RequestVerb>[^ ]*) (?P<URL>[^ ]*) (?P<Protocol>- |[^ ]*)"'

[elbtransformdecoder.message_fields]
Type = "ELBLogfile"
Logger = "elb"
Timestamp = "%Timestamp%"
ELBName = "%ELBName%"
RequestIP = "%RequestIP%"
RequestPort = "%RequestPort%"
BackendIP = "%BackendIP%"
BackendPort = "%BackendPort%"
RequestProcessingTime = "%RequestProcessingTime%"
BackendProcessingTime = "%BackendProcessingTime%"
ClientResponseTime = "%ClientResponseTime%"
ELBResponseCode = "%ELBResponseCode%"
BackendResponseCode = "%BackendResponseCode%"
ReceivedBytes|B = "%ReceivedBytes%"
SentBytes|B = "%SentBytes%"
RequestVerb = "%RequestVerb%"
Url|uri = "%URL%"
Protocol = "%Protocol%"

[ElasticSearchOutput]
message_matcher = "Type == 'ELBLogfile'"
cluster = "elasticsearch-cluster"
index = "elblog-%{field1}-%{2006.01.02.15.04.05}"
type_name = "elb.log.line-%{field1}"
server = "http://localhost:9200"
format = "clean"
flush_interval = 5000
flush_count = 10

[DashboardOutput]
ticker_interval = 30

[LogOutput]
message_matcher = "Logger == 'elb'"
payload_only = true