date {
match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
}
+ if [agent] == "-" {
+ mutate {
+ remove_field => [ "agent" ]
+ }
+ } else {
+ useragent {
+ source => "agent"
+ target => "useragent"
+ }
+ mutate {
+ rename => { "agent" => "[useragent][raw]" }
+ }
+ }
} else if [type] == "rails" {
json {
source => "message"
]
}
}
+
+ if [host] =~ /^spike-/ {
+ mutate {
+ add_tag => [ "frontend" ]
+ }
+ } else if [host] =~ /^thorn-/ {
+ mutate {
+ add_tag => [ "backend" ]
+ }
+ }
}
output {