sFlow Logstash Config (Dylan)

#INPUT SECTION
# // not sure how this will behave with different numbers of NICs need to test //

input {
    file {
     type  => "hsflowd"
     path => ["/home/ubuntu/hsflow.streamed"]

}}

#
# FILTER SECTION
#

filter {

  multiline {
  type => "hsflowd"
  pattern => "endDatagram   ================================="
  negate => true
  what => "previous"
}}

filter {

  grok {
  type => "hsflowd"
  patterns_dir => "/home/ubuntu/ls-config-examples/grok_pat"
  pattern => "%{DATA}%{SPACE}%{IP:datagramSourceIP}%{SPACE}%{DATA}%{SPACE}%{NUMBER:datagramSize}%{SPACE}%{DATA}%{SPACE}%{NUMBER:unixSecondsUTC}%{SPACE}%{DATA}%{SPACE}%{NUMBER:datagramVersion}%{SPACE}%{D
ATA}%{SPACE}%{NUMBER:agentSubID}%{SPACE}%{DATA}%{SPACE}%{IP:agent}%{SPACE}%{DATA}%{SPACE}%{NUMBER:packetSequenceNo}%{SPACE}%{DATA}%{SPACE}%{NUMBER:sysUpTime}%{SPACE}%{DATA}%{SPACE}%{NUMBER:samplesInPack
et}%{SPACE}%{WORD}%{SPACE}----------------------%{SPACE}%{DATA}sampleType_tag%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}%{WORD}%{SPACE}%{WORD:sampleType}%{SPACE}%{WORD}%{SPACE}%{NUMBER:sampleSequenceNo}%{SPACE}
%{DATA}%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER:ifIndex}%{SPACE}%{DATA}%{SPACE}%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER}%{SPACE}%{DATA}%{SPACE
}%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{DATA}%{SPACE}%{DATA}%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskTotal}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskFree}%{SPA
CE}%{DATA}%{SPACE}%{NUMBER:diskPartMaxUsed}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskReads}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskBytesRead}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskReadTime}%{SPACE}%{DATA}%{SPACE}%{N
UMBER:diskWrites}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskBytesWritten}%{SPACE}%{DATA}%{SPACE}%{NUMBER:diskWriteTime}%{SPACE}%{DATA}%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER:memTotal}%{SPACE
}%{DATA}%{SPACE}%{NUMBER:memFree}%{SPACE}%{DATA}%{SPACE}%{NUMBER:memShared}%{SPACE}%{DATA}%{SPACE}%{NUMBER:memBuffers}%{SPACE}%{DATA}%{SPACE}%{NUMBER:memCached}%{SPACE}%{DATA}%{SPACE}%{NUMBER:swapTotal}
%{SPACE}%{DATA}%{SPACE}%{NUMBER:swapFree}%{SPACE}%{DATA}%{SPACE}%{NUMBER:pageIn}%{SPACE}%{DATA}%{SPACE}%{NUMBER:pageOut}%{SPACE}%{DATA}%{SPACE}%{NUMBER:swapIn}%{SPACE}%{DATA}%{SPACE}%{NUMBER:swapOut}%{S
PACE}%{DATA}%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuLoadOne}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuLoadFive}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuLoadFifteen}%{SPACE}%{DATA}%{SPACE}%{NUMB
ER:cpuProcRun}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuProcTotal}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuNumber}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuSpeed}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuUptime}%{SPACE}%{DATA}%{S
PACE}%{NUMBER:cpuUser}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuNice}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuSystem}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuIdle}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuWio}%{SPACE}%{DATA}%{SP
ACE}%{NUMBER:cpuIntr}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuSintr}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuInterrupts}%{SPACE}%{DATA}%{SPACE}%{NUMBER:cpuContexts}%{SPACE}%{DATA}%{SPACE}%{NUMBER}:%{NUMBER}%{SPACE}
%{DATA}%{SPACE}%{NUMBER:nioBytesIn}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nioPacketsIn}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nioErrorsIn}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nioDropsIn}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nio
BytesOut}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nioPacketsOut}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nioErrorsOut}%{SPACE}%{DATA}%{SPACE}%{NUMBER:nioDropsOut}%{GREEDYDATA}"


}}

filter {
  mutate {

    convert => [ "nioBytesIn", "integer" ]
    convert => [ "nioBytesOut", "integer" ]

}}


output {


elasticsearch {

    bind_host => "0.0.0.0"
}}


#stdout {
# For debug to console purposes only
#    debug => true debug_format => "json"
#}