mirror of
https://github.com/elastic/logstash.git
synced 2025-04-24 22:57:16 -04:00
51e3ec62b4
* Add Logstash configs for filebeat modules Hand transpiled Logstash configs for FB modules to be included in the docs for 5.3. See FB modules for more details: https://github.com/elastic/beats/tree/master/filebeat/module * Fix newlines * Remove multiline, fix bugs
37 lines
1.2 KiB
Text
37 lines
1.2 KiB
Text
input {
|
|
beats {
|
|
# The port to listen on for filebeat connections.
|
|
port => 5044
|
|
# The IP address to listen for filebeat connections.
|
|
host => "0.0.0.0"
|
|
}
|
|
}
|
|
filter {
|
|
grok {
|
|
match => { "message" => ["%{LOCALDATETIME:[mysql][error][timestamp]} (\[%{DATA:[mysql][error][level]}\] )?%{GREEDYDATA:[mysql][error][message]}",
|
|
"%{TIMESTAMP_ISO8601:[mysql][error][timestamp]} %{NUMBER:[mysql][error][thread_id]} \[%{DATA:[mysql][error][level]}\] %{GREEDYDATA:[mysql][error][message1]}",
|
|
"%{GREEDYDATA:[mysql][error][message2]}"] }
|
|
pattern_definitions => {
|
|
"LOCALDATETIME" => "[0-9]+ %{TIME}"
|
|
}
|
|
remove_field => "message"
|
|
}
|
|
mutate {
|
|
rename => { "[mysql][error][message1]" => "[mysql][error][message]" }
|
|
}
|
|
mutate {
|
|
rename => { "[mysql][error][message2]" => "[mysql][error][message]" }
|
|
}
|
|
date {
|
|
match => [ "[mysql][error][timestamp]", "ISO8601", "YYMMdd H:m:s" ]
|
|
remove_field => "[apache2][access][time]"
|
|
}
|
|
}
|
|
output {
|
|
elasticsearch {
|
|
hosts => localhost
|
|
manage_template => false
|
|
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
|
|
document_type => "%{[@metadata][type]}"
|
|
}
|
|
}
|