Skip to content

Instantly share code, notes, and snippets.

@Dewep
Created November 21, 2015 14:47
Show Gist options
  • Save Dewep/f85e667f19537993a545 to your computer and use it in GitHub Desktop.
Save Dewep/f85e667f19537993a545 to your computer and use it in GitHub Desktop.
LogStash Grok - Match Nginx error - With multiline errors
input {
stdin {
}
}
filter {
mutate {
replace => {
"type" => "nginx-error"
}
}
multiline {
negate => 'true'
pattern => "^%{YEAR}/%{MONTHNUM}/%{MONTHDAY}"
what => 'previous'
}
mutate {
gsub => [ "message", "\r", "" ]
}
grok {
match => [
"message", "(?<timestamp>\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}) \[%{DATA:nginx_severity}\] %{NOTSPACE} %{NOTSPACE} (?<nginx_message>(.|\r|\n)*)(?:, client: (?<nginx_client_ip>%{IP}|%{HOSTNAME}))(?:, server: %{IPORHOST:nginx_server})(?:, request: %{QS:nginx_request})?(?:, host: %{QS:nginx_host})?(?:, referrer: \"%{URI:nginx_referrer})?"
]
}
mutate {
remove_tag => [ "multiline" ]
}
date {
match => [ "timestamp" , "yyyy/MM/dd HH:mm:ss" ]
timezone => 'UTC'
}
}
output {
stdout { codec => rubydebug }
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment