Tag logstash events as frontend or backend
[chef.git] / cookbooks / logstash / templates / default / logstash.conf.erb
1 input {
2   lumberjack {
3     port => 5043
4     ssl_certificate => "/var/lib/logstash/lumberjack.crt"
5     ssl_key => "/var/lib/logstash/lumberjack.key"
6   }
7 }
8
9 filter {
10   if [type] == "apache" {
11     grok {
12       match => [ "message", "%{COMBINEDAPACHELOG} %{NUMBER:duration:int}us %{NOTSPACE:request_id} %{NOTSPACE:ssl_protocol} %{NOTSPACE:ssl_cipher}" ]
13     }
14     date {
15       match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
16     }
17     if [agent] == "-" {
18       mutate {
19         remove_field => [ "agent" ]
20       }
21     } else {
22       useragent {
23         source => "agent"
24         target => "useragent"
25       }
26       mutate {
27         rename => { "agent" => "[useragent][raw]" }
28       }
29     }
30   } else if [type] == "rails" {
31     json {
32       source => "message"
33       remove_field => [
34         "message",
35         "[parameters][authenticity_token]",
36         "[parameters][pass_crypt]",
37         "[parameters][pass_crypt_confirmation]",
38         "[parameters][utf8]"
39       ]
40     }
41   }
42
43   if [host] =~ /^spike-/ {
44     mutate {
45       add_tag => [ "frontend" ]
46     }
47   } else if [host] =~ /^thorn-/ {
48     mutate {
49       add_tag => [ "backend" ]
50     }
51   }
52 }
53
54 output {
55   elasticsearch {
56     host => [ "127.0.0.1" ]
57     cluster => "<%= node[:elasticsearch][:cluster][:name] %>"
58   }
59 }