Apache Tomcat Logstash Filter

tomcat7.logstash.conf

# Based on http://spredzy.wordpress.com/2013/03/02/monitor-your-cluster-of-tomcat-applications-with-logstash-and-kibana/

# Changed URIPARAMS with GREEDYDATA.  URIPARAMS has problem with POST (i.e., no url parameters)


filter {
 
    grok {
        type => "access-log"
        pattern => "%{IP:client} \- \- \[%{DATA:datestamp}\] \"%{WORD:method} %{URIPATH:uri_path}%{GREEDYDATA:params} %{DATA:protocol}\" %{NUMBER:code} %{NUMBER:bytes}"
    }
 
    kv {
        type => "access-log"
        fields => ["params"]
        field_split=> "&?"
    }
 
        urldecode {
                type => "access-log"
                all_fields => true
        }
 
}