source => "agent"
target => "useragent"
}
+ grok {
+ match => { "agent" => "%{JOSM:[useragent][name]=JOSM}/%{POSINT:[useragent][major]}\.%{POSINT:[useragent][minor]} \(%{POSINT:[useragent][patch]} \w+\) " }
+ overwrite => [ "[useragent][name]", "[useragent][major]", "[useragent][minor]", "[useragent][patch]" ]
+ tag_on_failure => []
+ }
mutate {
rename => { "agent" => "[useragent][raw]" }
}
]
}
}
+
+ if [host] =~ /^spike-/ {
+ mutate {
+ add_tag => [ "frontend" ]
+ }
+ } else if [host] =~ /^thorn-/ {
+ mutate {
+ add_tag => [ "backend" ]
+ }
+ }
}
output {