mirror of
https://github.com/elastic/logstash.git
synced 2025-04-24 22:57:16 -04:00
51e3ec62b4
* Add Logstash configs for filebeat modules Hand transpiled Logstash configs for FB modules to be included in the docs for 5.3. See FB modules for more details: https://github.com/elastic/beats/tree/master/filebeat/module * Fix newlines * Remove multiline, fix bugs
39 lines
1.5 KiB
Text
39 lines
1.5 KiB
Text
input {
|
|
beats {
|
|
# The port to listen on for filebeat connections.
|
|
port => 5044
|
|
# The IP address to listen for filebeat connections.
|
|
host => "0.0.0.0"
|
|
}
|
|
}
|
|
filter {
|
|
grok {
|
|
match => { "message" => ["%{IPORHOST:[apache2][access][remote_ip]} - %{DATA:[apache2][access][user_name]} \[%{HTTPDATE:[apache2][access][time]}\] \"%{WORD:[apache2][access][method]} %{DATA:[apache2][access][url]} HTTP/%{NUMBER:[apache2][access][http_version]}\" %{NUMBER:[apache2][access][response_code]} %{NUMBER:[apache2][access][body_sent][bytes]}( \"%{DATA:[apache2][access][referrer]}\")?( \"%{DATA:[apache2][access][agent]}\")?",
|
|
"%{IPORHOST:[apache2][access][remote_ip]} - %{DATA:[apache2][access][user_name]} \\[%{HTTPDATE:[apache2][access][time]}\\] \"-\" %{NUMBER:[apache2][access][response_code]} -" ] }
|
|
remove_field => "message"
|
|
}
|
|
mutate {
|
|
add_field => { "read_timestamp" => "%{@timestamp}" }
|
|
}
|
|
date {
|
|
match => [ "[apache2][access][time]", "dd/MMM/YYYY:H:m:s Z" ]
|
|
remove_field => "[apache2][access][time]"
|
|
}
|
|
useragent {
|
|
source => "[apache2][access][agent]"
|
|
target => "[apache2][access][user_agent]"
|
|
remove_field => "[apache2][access][agent]"
|
|
}
|
|
geoip {
|
|
source => "[apache2][access][remote_ip]"
|
|
target => "[apache2][access][geoip]"
|
|
}
|
|
}
|
|
output {
|
|
elasticsearch {
|
|
hosts => localhost
|
|
manage_template => false
|
|
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
|
|
document_type => "%{[@metadata][type]}"
|
|
}
|
|
}
|