Teach logstash to recognise JOSM

diff --git a/cookbooks/logstash/templates/default/logstash.conf.erb b/cookbooks/logstash/templates/default/logstash.conf.erb
index cd5a7d24ab901095d28cfe3239b57932eb815f41..429370ea556c3afb418fb20433a3e57816d21f1d 100644 (file)
--- a/cookbooks/logstash/templates/default/logstash.conf.erb
+++ b/cookbooks/logstash/templates/default/logstash.conf.erb
@@ -23,6 +23,11 @@ filter {
         source => "agent"
         target => "useragent"
       }
         source => "agent"
         target => "useragent"
       }

+      grok {
+        match => { "agent" => "%{JOSM:[useragent][name]=JOSM}/%{POSINT:[useragent][major]}\.%{POSINT:[useragent][minor]} \(%{POSINT:[useragent][patch]} \w+\) " }
+        overwrite => [ "[useragent][name]", "[useragent][major]", "[useragent][minor]", "[useragent][patch]" ]
+        tag_on_failure => []
+      }

       mutate {
         rename => { "agent" => "[useragent][raw]" }
       }
       mutate {
         rename => { "agent" => "[useragent][raw]" }
       }