]> git.openstreetmap.org Git - chef.git/blob - cookbooks/logstash/templates/default/logstash.conf.erb
Enable beats input plugin to logstash
[chef.git] / cookbooks / logstash / templates / default / logstash.conf.erb
1 input {
2   lumberjack {
3     port => 5043
4     ssl_certificate => "/var/lib/logstash/lumberjack.crt"
5     ssl_key => "/var/lib/logstash/lumberjack.key"
6   }
7
8   beats {
9     port => 5044
10     ssl_certificate => "/var/lib/logstash/beats.crt"
11     ssl_key => "/var/lib/logstash/beats.key"
12   }
13 }
14
15 filter {
16   if [type] == "apache" {
17     grok {
18       match => [ "message", "%{COMBINEDAPACHELOG} %{NUMBER:duration:int}us %{NOTSPACE:request_id} %{NOTSPACE:ssl_protocol} %{NOTSPACE:ssl_cipher}" ]
19     }
20     date {
21       match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
22     }
23     if [agent] == "-" {
24       mutate {
25         remove_field => [ "agent" ]
26       }
27     } else {
28       useragent {
29         source => "agent"
30         target => "useragent"
31       }
32       grok {
33         match => { "agent" => "%{JOSM:[useragent][name]=JOSM}/%{POSINT:[useragent][major]}\.%{POSINT:[useragent][minor]} \(%{POSINT:[useragent][patch]} \w+\) " }
34         overwrite => [ "[useragent][name]", "[useragent][major]", "[useragent][minor]", "[useragent][patch]" ]
35         tag_on_failure => []
36       }
37       mutate {
38         rename => { "agent" => "[useragent][raw]" }
39       }
40     }
41   } else if [type] == "rails" {
42     json {
43       source => "message"
44       remove_field => [
45         "message",
46         "[parameters][authenticity_token]",
47         "[parameters][pass_crypt]",
48         "[parameters][pass_crypt_confirmation]",
49         "[parameters][utf8]"
50       ]
51     }
52     if [duration] {
53       ruby {
54         code => "event['duration'] = Integer(event['duration'] * 1000000)"
55       }
56     }
57     if [db] {
58       ruby {
59         code => "event['db'] = Integer(event['db'] * 1000000)"
60       }
61     }
62     if [view] {
63       ruby {
64         code => "event['view'] = Integer(event['view'] * 1000000)"
65       }
66     }
67   }
68
69   if [host] =~ /^spike-/ {
70     mutate {
71       add_tag => [ "frontend" ]
72     }
73   } else if [host] =~ /^thorn-/ {
74     mutate {
75       add_tag => [ "backend" ]
76     }
77   }
78 }
79
80 output {
81   elasticsearch {
82     hosts => [ "127.0.0.1" ]
83   }
84 }