Merge remote-tracking branch 'github/pull/503'

[chef.git] / cookbooks / logstash / templates / default / logstash.conf.erb

diff --git a/cookbooks/logstash/templates/default/logstash.conf.erb b/cookbooks/logstash/templates/default/logstash.conf.erb
index c036c1f7aab61c23e38b05edcd2198b59df863ad..cbc8c909bb89543cc3cebd638bead0e3a3998626 100644 (file)
--- a/cookbooks/logstash/templates/default/logstash.conf.erb
+++ b/cookbooks/logstash/templates/default/logstash.conf.erb
@@ -1,8 +1,9 @@
 input {
-  lumberjack {
-    port => 5043
-    ssl_certificate => "/var/lib/logstash/lumberjack.crt"
-    ssl_key => "/var/lib/logstash/lumberjack.key"
+  beats {
+    port => 5044
+    ssl => true
+    ssl_certificate => "/var/lib/logstash/beats.crt"
+    ssl_key => "/var/lib/logstash/beats.key"
   }
 }
 
@@ -23,6 +24,11 @@ filter {
         source => "agent"
         target => "useragent"
       }
+      grok {
+        match => { "agent" => "%{JOSM:[useragent][name]=JOSM}/%{POSINT:[useragent][major]}\.%{POSINT:[useragent][minor]} \(%{POSINT:[useragent][patch]} \w+\) " }
+        overwrite => [ "[useragent][name]", "[useragent][major]", "[useragent][minor]", "[useragent][patch]" ]
+        tag_on_failure => []
+      }
       mutate {
         rename => { "agent" => "[useragent][raw]" }
       }
@@ -38,12 +44,36 @@ filter {
         "[parameters][utf8]"
       ]
     }
+    if [duration] {
+      ruby {
+        code => "event['duration'] = Integer(event['duration'] * 1000000)"
+      }
+    }
+    if [db] {
+      ruby {
+        code => "event['db'] = Integer(event['db'] * 1000000)"
+      }
+    }
+    if [view] {
+      ruby {
+        code => "event['view'] = Integer(event['view'] * 1000000)"
+      }
+    }
+  }
+
+  if [host] =~ /^spike-/ {
+    mutate {
+      add_tag => [ "frontend" ]
+    }
+  } else if [host] =~ /^thorn-/ {
+    mutate {
+      add_tag => [ "backend" ]
+    }
   }
 }
 
 output {
   elasticsearch {
-    host => [ "127.0.0.1" ]
-    cluster => "<%= node[:elasticsearch][:cluster][:name] %>"
+    hosts => [ "127.0.0.1" ]
   }
 }