Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- filter {
- if [type] == "cloudfront" {
- if ( ("#Version: 1.0" in [message]) or ("#Fields: date" in [message])) {
- drop {}
- }
- grok {
- match => { "message" => "%{DATE_US:date}\t%{TIME:time}\t%{WORD:x_edge_location}\t(?:%{NUMBER:sc_bytes}|-)\t%{IPORHOST:c_ip}\t%{WORD:cs_method}\t%{HOSTNAME:cs_host}\t%{NOTSPACE:cs_uri_stem}\t%{NUMBER:sc_status}\t%{GREEDYDATA:referrer}\t%{GREEDYDATA:User_Agent}\t%{GREEDYDATA:cs_uri_stem}\t%{GREEDYDATA:cookies}\t%{WORD:x_edge_result_type}\t%{NOTSPACE:x_edge_request_id}\t%{HOSTNAME:x_host_header}\t%{URIPROTO:cs_protocol}\t%{INT:cs_bytes}\t%{GREEDYDATA:time_taken}\t%{GREEDYDATA:x_forwarded_for}\t%{GREEDYDATA:ssl_protocol}\t%{GREEDYDATA:ssl_cipher}\t%{GREEDYDATA:x_edge_response_result_type}" }
- }
- mutate {
- add_field => [ "received_at", "%{@timestamp}" ]
- add_field => [ "listener_timestamp", "%{date} %{time}" ]
- }
- date {
- match => [ "listener_timestamp", "yy-MM-dd HH:mm:ss" ]
- }
- date {
- locale => "en"
- timezone => "UCT"
- match => [ "listener_timestamp", "yy-MM-dd HH:mm:ss" ]
- target => "@timestamp"
- }
- }
- }
Add Comment
Please, Sign In to add comment