5537e8b378
The geoip capabilities are built into logstash and can help a deployer better understand the workloads they're running within their environments. This change adds geoip capabilities in line with the recommended practice from elastic. Link: https://www.elastic.co/blog/geoip-in-the-elastic-stack Change-Id: I109879bd9aeeaa0312eb3303e2e7566181ecff91 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
32 lines
1.1 KiB
Plaintext
32 lines
1.1 KiB
Plaintext
filter {
|
|
if "horizon" in [tags] {
|
|
grok {
|
|
patterns_dir => ["/opt/logstash/patterns"]
|
|
match => {
|
|
"message" => [
|
|
"%{COMMONAPACHELOG}",
|
|
"\[%{APACHE_ERROR_TIMESTAMP:timestamp}\] \[%{DATA:module}:%{DATA:loglevel}\] \[pid %{POSINT:apache_pid}\:tid %{POSINT:apache_tid}\] ?(?:\[client %{IP:clientip}:%{POSINT:clientport}\] )?%{GREEDYDATA:logmessage}",
|
|
"%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{SYSLOGHOST:host}%{SPACE}%{PROG:prog}%{SPACE}%{IP:clientip}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{SYSLOG5424SD}%{SPACE}%{QS}%{SPACE}%{NUMBER}%{SPACE}%{NUMBER}%{SPACE}%{QS}%{SPACE}%{QS}"
|
|
]
|
|
}
|
|
}
|
|
geoip {
|
|
source => "clientip"
|
|
}
|
|
if ![loglevel] {
|
|
mutate {
|
|
add_field => { "logmessage" => "%{request}" }
|
|
add_field => { "module" => "horizon.access" }
|
|
add_field => { "loglevel" => "INFO" }
|
|
add_tag => [ "apache-access" ]
|
|
}
|
|
} else {
|
|
mutate {
|
|
replace => { "module" => "horizon.error.%{module}" }
|
|
add_tag => [ "apache-error" ]
|
|
uppercase => [ "loglevel" ]
|
|
}
|
|
}
|
|
}
|
|
}
|