daily pastebin goal
51%
SHARE
TWEET

Filebeat to logstash _grokparsefailure

a guest Mar 7th, 2016 148 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ####Logstash Config
  2.  
  3. input {
  4.   beats {
  5.     port => 5044
  6.   }
  7. }
  8.  
  9. filter {
  10.   if [source] == "/var/log/syslog" {
  11.     grok {
  12.       match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  13.     }
  14.     date {
  15.       match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
  16.     }
  17.   }
  18. }
  19.  
  20. output {
  21.   elasticsearch {
  22.     hosts => "localhost:9200"
  23.     manage_template => false
  24.     index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
  25.     document_type => "%{[@metadata][type]}"
  26.   }
  27. }
  28.  
  29.  
  30. ####Sample syslog line
  31. {"@timestamp":"2016-03-07T20:05:04.491Z","beat":{"hostname":"base","name":"base"},"count":1,"fields":null,"input_type":"log","message":"Mar  7 12:05:01 base CRON[15517]: (root) CMD (command -v debian-sa1 \u003e /dev/null \u0026\u0026 debian-sa1 1 1)","offset":119040,"source":"/var/log/syslog","type":"log"}
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top