NOTE - this was specifically built for a docker instance, with the Filebeat docker module collecting the logs.
Peter Titov iamhowardtheduck
romicgd
/ Azure_AGW_accesslog.jsonparser.properties
Last active
November 2, 2018 19:15
ArcSight FlexConnector JSON Folder Follower - mapping of Azure Application Gateway access log
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| trigger.node.location=/records/properties | |
| token.count=10 | |
| token[0].name=operationName | |
| token[0].type=String | |
| token[0].location=../operationName | |
| token[1].name=time | |
| token[1].type=String | |
| token[1].location=../time | |
| token[2].name=clientIP | |
| token[2].type=String |