Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- filter {
- if [type] == "nginx_error_log" {
- grok {
- id => "nginx_error_grok_filter"
- patterns_dir => ["/etc/logstash/patterns"]
- match => { message => "^%{NGINXTIMESTAMP:timestamp}%{SPACE}[%{WORD:error_level}]%{SPACE}%{POSINT:pid}#%{POSINT:tid}:%{SPACE}(*(?\d+))?%{SPACE}((,%{SPACE}client:%{SPACE}%{IPORHOST:client})|(,%{SPACE}server:%{SPACE}%{IPORHOST:server})|(,%{SPACE}host:%{SPACE}%{IPORHOST:host})|(,%{SPACE}request:%{SPACE}"%{QS:request})|(,%{SPACE}upstream:%{SPACE}"%{QS:upstream})|(,%{SPACE}referrer:%{SPACE}"%{QS:referrer}))$" }
- add_tag => [ "_nginx_error_grok_filter" ]
- tag_on_failure => [ "_grokparsefailure_nginx_error_grok_filter" ]
- }
- date {
- id => "nginx_error_date_filter"
- match => [ "timestamp", "yyyy/MM/dd HH:mm:ss" ]
- locale => "en-US"
- timezone => "Europe/Berlin"
- target => "@timestamp"
- }
- }
- }
Add Comment
Please, Sign In to add comment