23ac2aa985
This adds the ability to include logstash log parsing filters for various openstack and service logs. These filters are disabled by default and can be enabled by toggling the deploy_logstash_filters variable. Change-Id: I5c46f78f232d3fb604283ae623cd3975a8346c7c
57 lines
1.9 KiB
Plaintext
57 lines
1.9 KiB
Plaintext
filter {
|
|
if "swift-container" in [tags] {
|
|
grok {
|
|
match => {
|
|
"message" => "%{CISCOTIMESTAMP}%{SPACE}%{S3_REQUEST_LINE}%{SPACE}%{CISCOTIMESTAMP}%{SPACE}%{HOSTNAME}%{SPACE}%{PROG}%{SPACE}%{USER}%{SPACE}%{USERNAME}%{SPACE}%{NOTSPACE}%{SPACE}%{S3_REQUEST_LINE}%{SPACE}%{HTTPDUSER}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{INT}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{SECOND}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}"
|
|
}
|
|
}
|
|
}
|
|
if "swift-account" in [tags] {
|
|
grok {
|
|
match => {
|
|
"message" => "%{SYSLOGTIMESTAMP}%{SPACE}%{HOSTNAME}%{SPACE}%{PROG}%{SPACE}%{SYSLOGTIMESTAMP}%{SPACE}%{S3_REQUEST_LINE}%{SPACE}%{IP}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{SYSLOG5424SD}%{SPACE}%{QS}%{SPACE}%{POSINT}%{SPACE}%{NOTSPACE}%{SPACE}%{QS}%{SPACE}%{QS}%{SPACE}%{QS}%{SPACE}%{SECOND}%{SPACE}%{QS}%{SPACE}%{NUMBER}%{SPACE}%{NOTSPACE}"
|
|
}
|
|
}
|
|
}
|
|
if "swift" in [tags] {
|
|
grok {
|
|
match => {
|
|
"message" => "%{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{NOTSPACE:logsource} %{SYSLOGPROG:module}: (?:%{SPACE})?%{GREEDYDATA:logmessage}"
|
|
}
|
|
}
|
|
|
|
grok {
|
|
patterns_dir => ['/opt/logstash/patterns']
|
|
match => {
|
|
"logmessage" => [
|
|
"%{COMBINEDAPACHELOG}",
|
|
"%{SWIFTPROXY_ACCESS}",
|
|
"%{GREEDYDATA:logmessage} \(txn\: %{DATA:swift_txn}\)"
|
|
]
|
|
}
|
|
tag_on_failure => []
|
|
overwrite => [ "logmessage" ]
|
|
}
|
|
|
|
if [request] {
|
|
mutate {
|
|
replace => { "logmessage" => "%{request}" }
|
|
}
|
|
}
|
|
|
|
mutate {
|
|
replace => { "module" => "swift.%{module}" }
|
|
}
|
|
|
|
if [file] =~ "error.log$" {
|
|
mutate {
|
|
add_field => { "loglevel" => "NOTICE" }
|
|
}
|
|
} else {
|
|
mutate {
|
|
add_field => { "loglevel" => "INFO" }
|
|
}
|
|
}
|
|
}
|
|
}
|