37 lines
905 B
Plaintext
37 lines
905 B
Plaintext
filter {
|
|
grok {
|
|
match => { "message" => "%{TIMESTAMP_ISO8601:oldtimestamp}\s+\[%{DATA:service}\]\s+\[TID:%{NOTSPACE:tid}\]\s+\[%{DATA:thread}\]\s+%{LOGLEVEL:loglevel}\s+%{NOTSPACE:class}\s+-%{GREEDYDATA:oldmessage}"}
|
|
}
|
|
|
|
|
|
date {
|
|
match => ["oldtimestamp", "ISO8601"]
|
|
target => "@timestamp"
|
|
}
|
|
mutate {
|
|
replace => { "message" => "%{oldmessage}" }
|
|
remove_field => [ "oldmessage","oldtimestamp","agent","host","input","log.flags","log.flags.keyword","tags" ]
|
|
}
|
|
}
|
|
|
|
|
|
output {
|
|
if [servicename] {
|
|
elasticsearch {
|
|
hosts => [ "prod-es-elasticsearch:9200" ]
|
|
index => "sslog-%{[service]}"
|
|
action => "create"
|
|
ilm_enabled => false
|
|
}
|
|
}else{
|
|
elasticsearch {
|
|
hosts => [ "prod-es-elasticsearch:9200" ]
|
|
index => "sslog-default"
|
|
action => "create"
|
|
ilm_enabled => false
|
|
}
|
|
}
|
|
}
|
|
|
|
|