Teach logstash to recognise JOSM
authorTom Hughes <tom@compton.nu>
Mon, 21 Mar 2016 15:05:12 +0000 (15:05 +0000)
committerTom Hughes <tom@compton.nu>
Mon, 21 Mar 2016 15:05:12 +0000 (15:05 +0000)
cookbooks/logstash/templates/default/logstash.conf.erb

index cd5a7d2..429370e 100644 (file)
@@ -23,6 +23,11 @@ filter {
         source => "agent"
         target => "useragent"
       }
+      grok {
+        match => { "agent" => "%{JOSM:[useragent][name]=JOSM}/%{POSINT:[useragent][major]}\.%{POSINT:[useragent][minor]} \(%{POSINT:[useragent][patch]} \w+\) " }
+        overwrite => [ "[useragent][name]", "[useragent][major]", "[useragent][minor]", "[useragent][patch]" ]
+        tag_on_failure => []
+      }
       mutate {
         rename => { "agent" => "[useragent][raw]" }
       }