Guest User

Untitled

a guest
Mar 22nd, 2018
85
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.95 KB | None | 0 0
  1. filter {
  2. if [type] == "nginx_error_log" {
  3. grok {
  4. id => "nginx_error_grok_filter"
  5. patterns_dir => ["/etc/logstash/patterns"]
  6. match => { message => "^%{NGINXTIMESTAMP:timestamp}%{SPACE}[%{WORD:error_level}]%{SPACE}%{POSINT:pid}#%{POSINT:tid}:%{SPACE}(*(?\d+))?%{SPACE}((,%{SPACE}client:%{SPACE}%{IPORHOST:client})|(,%{SPACE}server:%{SPACE}%{IPORHOST:server})|(,%{SPACE}host:%{SPACE}%{IPORHOST:host})|(,%{SPACE}request:%{SPACE}"%{QS:request})|(,%{SPACE}upstream:%{SPACE}"%{QS:upstream})|(,%{SPACE}referrer:%{SPACE}"%{QS:referrer}))$" }
  7. add_tag => [ "_nginx_error_grok_filter" ]
  8. tag_on_failure => [ "_grokparsefailure_nginx_error_grok_filter" ]
  9. }
  10. date {
  11. id => "nginx_error_date_filter"
  12. match => [ "timestamp", "yyyy/MM/dd HH:mm:ss" ]
  13. locale => "en-US"
  14. timezone => "Europe/Berlin"
  15. target => "@timestamp"
  16. }
  17. }
  18. }
Add Comment
Please, Sign In to add comment