Advertisement
Guest User

Untitled

a guest
Oct 9th, 2015
93
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.86 KB | None | 0 0
  1. filter {
  2. if [type] == "mongostat" {
  3. grok {
  4. patterns_dir => "/etc/logstash/patterns"
  5. match => ["message","%{HOSTNAME:host}:%{INT:port} %{INSERT}%{QUERY}%{UPDATE}%{DELETE}%{GETMORE}%{SPACE}%{NUMBER:mongoCommand}\|%{NUMBER:mongoReplCommand}%{SPACE}%{NUMBER:mongoDirty}%{SPACE}%{NUMBER:mongoUsed}%{SPACE}%{NUMBER:mongoFlushes}%{SIZE}%{RES}%{SPACE}%{NUMBER:mongoQR}\|%{NUMBER:mongoQW}%{SPACE}%{NUMBER:mongoAR}\|%{NUMBER:mongoAW}%{NETIN}%{NETOUT}%{SPACE}%{NUMBER:mongoConnections}%{SPACE}%{NOTSPACE:mongoReplSet}%{SPACE}%{WORD:mongoReplMember}%{SPACE}%{TIME:mongoTime}"]
  6. }
  7. if [mongoNetInQualifier] == 'b' {
  8. ruby {
  9. code => "event['mongoNetInKB'] = event['mongoNetIn'].to_f / 1024"
  10. }
  11. }
  12. if [mongoNetInQualifier] == 'k' {
  13. ruby {
  14. code => "event['mongoNetInKB'] = event['mongoNetIn'].to_f * 1"
  15. }
  16. }
  17. if [mongoNetInQualifier] == 'm' {
  18. ruby {
  19. code => "event['mongoNetInKB'] = event['mongoNetIn'].to_f * 1024"
  20. }
  21. }
  22. if [mongoNetInQualifier] == 'g' {
  23. ruby {
  24. code => "event['mongoNetInKB'] = event['mongoNetIn'].to_f * 1048576"
  25. }
  26. }
  27.  
  28. mutate {
  29. convert => { "mongoAW" => "integer" }
  30. convert => { "mongoAR" => "integer" }
  31. convert => { "mongoDirty" => "float" }
  32. convert => { "mongoSize" => "float" }
  33. convert => { "mongoUpdate" => "integer" }
  34. convert => { "mongoInsert" => "integer" }
  35. convert => { "port" => "integer" }
  36. convert => { "mongoNetIn" => "integer" }
  37. convert => { "mongoQR" => "integer" }
  38. convert => { "mongoConnections" => "integer" }
  39. convert => { "mongoRes" => "float" }
  40. convert => { "mongoGetmore" => "integer" }
  41. convert => { "mongoCommand" => "integer" }
  42. convert => { "mongoQuery" => "integer" }
  43. convert => { "mongoDelete" => "integer" }
  44. convert => { "mongoUsed" => "float" }
  45. convert => { "mongoNetOut" => "integer" }
  46. convert => { "mongoFlushes" => "integer" }
  47. }
  48.  
  49. }
  50. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement