cookbooks/logstash/templates/default/logstash.conf.erb

   1 input {
   2   lumberjack {
   3     port => 5043
   4     ssl_certificate => "/var/lib/logstash/lumberjack.crt"
   5     ssl_key => "/var/lib/logstash/lumberjack.key"
   6   }
   7
   8   beats {
   9     port => 5044
  10     ssl_certificate => "/var/lib/logstash/beats.crt"
  11     ssl_key => "/var/lib/logstash/beats.key"
  12   }
  13 }
  14
  15 filter {
  16   if [type] == "apache" {
  17     grok {
  18       match => [ "message", "%{COMBINEDAPACHELOG} %{NUMBER:duration:int}us %{NOTSPACE:request_id} %{NOTSPACE:ssl_protocol} %{NOTSPACE:ssl_cipher}" ]
  19     }
  20     date {
  21       match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
  22     }
  23     if [agent] == "-" {
  24       mutate {
  25         remove_field => [ "agent" ]
  26       }
  27     } else {
  28       useragent {
  29         source => "agent"
  30         target => "useragent"
  31       }
  32       grok {
  33         match => { "agent" => "%{JOSM:[useragent][name]=JOSM}/%{POSINT:[useragent][major]}\.%{POSINT:[useragent][minor]} \(%{POSINT:[useragent][patch]} \w+\) " }
  34         overwrite => [ "[useragent][name]", "[useragent][major]", "[useragent][minor]", "[useragent][patch]" ]
  35         tag_on_failure => []
  36       }
  37       mutate {
  38         rename => { "agent" => "[useragent][raw]" }
  39       }
  40     }
  41   } else if [type] == "rails" {
  42     json {
  43       source => "message"
  44       remove_field => [
  45         "message",
  46         "[parameters][authenticity_token]",
  47         "[parameters][pass_crypt]",
  48         "[parameters][pass_crypt_confirmation]",
  49         "[parameters][utf8]"
  50       ]
  51     }
  52     if [duration] {
  53       ruby {
  54         code => "event['duration'] = Integer(event['duration'] * 1000000)"
  55       }
  56     }
  57     if [db] {
  58       ruby {
  59         code => "event['db'] = Integer(event['db'] * 1000000)"
  60       }
  61     }
  62     if [view] {
  63       ruby {
  64         code => "event['view'] = Integer(event['view'] * 1000000)"
  65       }
  66     }
  67   }
  68
  69   if [host] =~ /^spike-/ {
  70     mutate {
  71       add_tag => [ "frontend" ]
  72     }
  73   } else if [host] =~ /^thorn-/ {
  74     mutate {
  75       add_tag => [ "backend" ]
  76     }
  77   }
  78 }
  79
  80 output {
  81   elasticsearch {
  82     hosts => [ "127.0.0.1" ]
  83   }
  84 }