filter {
if [type] == "apache" {
grok {
- match => [ "message", "%{COMBINEDAPACHELOG} %{NUMBER:duration:int}us %{WORD:request_id} %{NOTSPACE:ssl_protocol} %{NOTSPACE:ssl_cipher}" ]
+ match => [ "message", "%{COMBINEDAPACHELOG} %{NUMBER:duration:int}us %{NOTSPACE:request_id} %{NOTSPACE:ssl_protocol} %{NOTSPACE:ssl_cipher}" ]
}
date {
match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
} else if [type] == "rails" {
json {
source => "message"
+ remove_field => [
+ "message",
+ "[parameters][authenticity_token]",
+ "[parameters][pass_crypt]",
+ "[parameters][pass_crypt_confirmation]",
+ "[parameters][utf8]"
+ ]
}
}
}
output {
elasticsearch {
host => [ "127.0.0.1" ]
+ cluster => "<%= node[:elasticsearch][:cluster][:name] %>"
}
}