Skip to content

Instantly share code, notes, and snippets.

@brasic
Created November 25, 2014 17:50
Show Gist options
  • Save brasic/fb6a043e67684c671493 to your computer and use it in GitHub Desktop.
Save brasic/fb6a043e67684c671493 to your computer and use it in GitHub Desktop.
logstash postgres
filter {
if [type] == 'postgres_csv' {
csv {
columns => [
"pg_timestamp",
"user_name",
"database_name",
"process_id",
"connection_from",
"session_id",
"session_line_num",
"command_tag text,",
"session_start_time",
"virtual_transaction_id",
"transaction_id",
"error_severity",
"sql_state_code",
"log_message",
"detail",
"hint",
"internal_query",
"internal_query_pos",
"context",
"query",
"query_pos",
"location",
"application_name"
]
}
mutate {
gsub => [ "pg_timestamp", " \w{3}$", "" ]
}
date {
match => [ "pg_timestamp", "yyyy-MM-dd HH:mm:ss.SSS" ]
}
if [log_message] =~ "duration" {
grok {
match => [ "log_message", "duration: %{NUMBER:duration_ms} ms (execute|statement)(\s\S+)?: %{PG_STATEMENT:statement}" ]
}
mutate {
convert => [ "duration_ms", "float" ]
}
}
}
}
@a320321wb
Copy link

hi does't have input , output

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment