From 90580469ec4436695588f53e00e16f1907fd33b5 Mon Sep 17 00:00:00 2001
From: Jordan Sissel <jls@semicomplete.com>
Date: Wed, 17 Aug 2011 01:08:04 -0700
Subject: [PATCH] - adde xample exec+split config

---
 etc/examples/exec-split.conf | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 etc/examples/exec-split.conf

diff --git a/etc/examples/exec-split.conf b/etc/examples/exec-split.conf
new file mode 100644
index 000000000..557a76365
--- /dev/null
+++ b/etc/examples/exec-split.conf
@@ -0,0 +1,25 @@
+input {
+  exec {
+    type => "foo"
+
+    # Grab one run of top
+    command => "top -bn1"
+
+    # Every 5 seconds
+    interval => 5
+  }
+}
+
+filter {
+  split { type => "foo" } 
+
+  # Parse fields out of top. This assumes the default headers of:
+  # PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
+  grok { 
+    type => "foo" 
+    pattern => "%{NUMBER:pid} *%{WORD:user} *%{NUMBER:priority} *%{NUMBER:nice} *%{NOTSPACE:vmsize} *%{NOTSPACE:rss} *%{NOTSPACE:sharedmemory} *%{WORD:state} *%{NUMBER:cpu_pct} *%{NUMBER:memory_pct} *%{NOTSPACE:cputime} %{DATA:command}" 
+  }
+}
+
+output { stdout { debug => true } }
+