diff --git a/apache_stdout.conf b/apache_stdout.conf deleted file mode 100644 index 8e9968248..000000000 --- a/apache_stdout.conf +++ /dev/null @@ -1,88 +0,0 @@ -input { - file { - id => "logfileRead" - start_position => beginning - ignore_older => 0 - path => "/Users/andrewvc/projects/ls_apache_materials/apache_access_logs" - } - - stdin {id => logStdin} -} - -filter { - grok { - id => "apacheCommonLog" - match => { - "message" => '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent}' - } - } - - geoip { - id => "clientGeo" - source => clientip - target => geoip - } - - useragent { - id => "clientUA" - source => agent - target => useragent - } - - - date { - id => "clientDate" - match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ] - locale => en - } - - if [geoip][country_code2] == "US" { - mutate { - id => "addUsRegion" - add_field => { "aws-region" => "us-east-1" } - } - } else if [geoip][country_code2] == "CA" { - if [referrer] =~ /google/ { - sleep { - id => "pointlessSleep" - time => 0.001 - } - } - } else { - mutate { - id => addOtherRegion - add_field => { "aws-region" => "eu-central-1" } - } - } - - - if [request] =~ /(?i)\.(png|jpg|gif)$/ { - grok { - id => grokImage - match => { - request => "%{(?i)\.(png|jpg|gif)$:extension}" - } - add_tag => ["image"] - } - - mutate { - id => addCanadianRegion - add_field => { "aws-region" => "ca-central-1" } - } - } else if [request] =~ /articles/ { - mutate { - id => tagArticle - add_tag => ["article"] - } - } -} - -output { - elasticsearch { - id => "mainEs" - index => "%{@type}-" - } - if [geoip][country_code2] != "US" { - stdout { id => "linuxStdout" codec => json_lines } - } -}