Skip to content

Instantly share code, notes, and snippets.

@hamiltont
Last active August 29, 2015 14:06
Show Gist options
  • Save hamiltont/988732b727466202375c to your computer and use it in GitHub Desktop.
Save hamiltont/988732b727466202375c to your computer and use it in GitHub Desktop.
input {
stdin {
type => "stdin-type"
}
#file {
# type => "syslog"
# path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
# start_position => "beginning"
#}
file {
type => "couchpotato"
path => [ "/logs/couchpotato/CouchPotato.*" ]
start_position => "beginning"
# Combine tracebacks into one event
codec => multiline {
pattern => "^%{MONTHNUM}-%{MONTHDAY} %{TIME} %{LOGLEVEL}"
negate => true
what => previous
}
}
}
filter {
# Get rid of color codes
mutate {
gsub => [ "message", "\e\[0m", ""]
}
grok {
# 09-04 20:48:55 INFO [ie.providers.info.omdbapi] Found: Only Lovers Left Alive (2013)
match => [ "message", "%{MONTHNUM}-%{MONTHDAY} %{TIME} %{LOGLEVEL} \[(?:%{SPACE})%{NOTSPACE:module}\] %{GREEDYDATA:couch_message}" ]
}
}
output {
elasticsearch {
embedded => true
}
}
@untergeek
Copy link

I used this updated pattern to catch both:

pattern => [ "%{MONTHNUM}-%{MONTHDAY} %{TIME} %{LOGLEVEL} \[(?:%{SPACE})%{NOTSPACE:module}\] %{GREEDYDATA:couch_message}" ]

09-04 19:54:28 INFO \e[0m[  couchpotato.core.loader] Loaded media_movie_providers_userscript: reddit\e[0m
{
          "message" => "09-04 19:54:28 INFO [  couchpotato.core.loader] Loaded media_movie_providers_userscript: reddit",
         "@version" => "1",
       "@timestamp" => "2014-09-05T20:19:16.092Z",
             "host" => "aironaut.untergeek.net",
           "module" => "couchpotato.core.loader",
    "couch_message" => "Loaded media_movie_providers_userscript: reddit"
}
09-04 20:48:55 INFO [ie.providers.info.omdbapi] Found: Only Lovers Left Alive (2013)
{
          "message" => "09-04 20:48:55 INFO [ie.providers.info.omdbapi] Found: Only Lovers Left Alive (2013)",
         "@version" => "1",
       "@timestamp" => "2014-09-05T20:19:26.215Z",
             "host" => "aironaut.untergeek.net",
           "module" => "ie.providers.info.omdbapi",
    "couch_message" => "Found: Only Lovers Left Alive (2013)"

@hamiltont
Copy link
Author

Thanks @untergeek! This was driving me crazy :-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment