mirror of
https://github.com/elastic/logstash.git
synced 2025-04-24 14:47:19 -04:00
parent
76711a4785
commit
6ec69c1ce2
1 changed files with 0 additions and 88 deletions
|
@ -1,88 +0,0 @@
|
|||
input {
|
||||
file {
|
||||
id => "logfileRead"
|
||||
start_position => beginning
|
||||
ignore_older => 0
|
||||
path => "/Users/andrewvc/projects/ls_apache_materials/apache_access_logs"
|
||||
}
|
||||
|
||||
stdin {id => logStdin}
|
||||
}
|
||||
|
||||
filter {
|
||||
grok {
|
||||
id => "apacheCommonLog"
|
||||
match => {
|
||||
"message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}'
|
||||
}
|
||||
}
|
||||
|
||||
geoip {
|
||||
id => "clientGeo"
|
||||
source => clientip
|
||||
target => geoip
|
||||
}
|
||||
|
||||
useragent {
|
||||
id => "clientUA"
|
||||
source => agent
|
||||
target => useragent
|
||||
}
|
||||
|
||||
|
||||
date {
|
||||
id => "clientDate"
|
||||
match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
|
||||
locale => en
|
||||
}
|
||||
|
||||
if [geoip][country_code2] == "US" {
|
||||
mutate {
|
||||
id => "addUsRegion"
|
||||
add_field => { "aws-region" => "us-east-1" }
|
||||
}
|
||||
} else if [geoip][country_code2] == "CA" {
|
||||
if [referrer] =~ /google/ {
|
||||
sleep {
|
||||
id => "pointlessSleep"
|
||||
time => 0.001
|
||||
}
|
||||
}
|
||||
} else {
|
||||
mutate {
|
||||
id => addOtherRegion
|
||||
add_field => { "aws-region" => "eu-central-1" }
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
if [request] =~ /(?i)\.(png|jpg|gif)$/ {
|
||||
grok {
|
||||
id => grokImage
|
||||
match => {
|
||||
request => "%{(?i)\.(png|jpg|gif)$:extension}"
|
||||
}
|
||||
add_tag => ["image"]
|
||||
}
|
||||
|
||||
mutate {
|
||||
id => addCanadianRegion
|
||||
add_field => { "aws-region" => "ca-central-1" }
|
||||
}
|
||||
} else if [request] =~ /articles/ {
|
||||
mutate {
|
||||
id => tagArticle
|
||||
add_tag => ["article"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output {
|
||||
elasticsearch {
|
||||
id => "mainEs"
|
||||
index => "%{@type}-"
|
||||
}
|
||||
if [geoip][country_code2] != "US" {
|
||||
stdout { id => "linuxStdout" codec => json_lines }
|
||||
}
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue