LexxFedoroff · January 26, 2016 07:15 · coder-sreeraj · Nov 1, 2017
diff --git a/gistfile1.txt b/gistfile1.txt
 input {
        file {
                path => "/var/log/cassandra/system.log"
                #start_position => "beginning"
        }
        #stdin { }
 }

 filter {
        multiline {
                pattern => "^(INFO|WARN|ERROR)"
                what => "previous"
                negate=> true
        }
        grok {
                match => [ "message", "%{LOGLEVEL:level} %{DATA} %{TIMESTAMP_ISO8601:logdate} %{DATA} - %{GREEDYDATA:text}" ]
        }
        date {
                match  => [ "logdate", "yyyy-MM-dd HH:mm:ss,SSSS" ]
        }
        mutate {
                add_field => {
                        "subsystem" => "cassandra"
                }
        }
 }

 output {
        #stdout { codec => rubydebug }
        elasticsearch {
                hosts => ["elastic.local:9200"]
                index => "cassandra-%{+YYYY.MM.dd}"
        }
 }
	input {
	file {
	path => "/var/log/cassandra/system.log"
	#start_position => "beginning"
	}
	#stdin { }
	}

	filter {
	multiline {
	pattern => "^(INFO\|WARN\|ERROR)"
	what => "previous"
	negate=> true
	}
	grok {
	match => [ "message", "%{LOGLEVEL:level} %{DATA} %{TIMESTAMP_ISO8601:logdate} %{DATA} - %{GREEDYDATA:text}" ]
	}
	date {
	match => [ "logdate", "yyyy-MM-dd HH:mm:ss,SSSS" ]
	}
	mutate {
	add_field => {
	"subsystem" => "cassandra"
	}
	}
	}

	output {
	#stdout { codec => rubydebug }
	elasticsearch {
	hosts => ["elastic.local:9200"]
	index => "cassandra-%{+YYYY.MM.dd}"
	}
	}