Skip to content

Instantly share code, notes, and snippets.

@nimboya
Created September 25, 2018 14:40
Show Gist options
  • Save nimboya/3ef3200c792df6873305cf6dd32a855b to your computer and use it in GitHub Desktop.
Save nimboya/3ef3200c792df6873305cf6dd32a855b to your computer and use it in GitHub Desktop.
Convert Nginx to JSON using Logstash
input {
file{
path=>["/media/access*"]
start_position=>"beginning"
}
}
filter {
grok {
match => { "message" => ["%{IPORHOST:[remote_ip]} - %{DATA:[user_name]} \[%{HTTPDATE:[time]}\] \"%{WORD:[method]} %{DATA:[url]} HTTP/%{NUMBER:[http_version]}\" %{NUMBER:[response_code]} %{NUMBER:[body_sent_bytes]} \"%{DATA:[referrer]}\" \"%{DATA:[agent]}\""] }
remove_field => "message"
}
mutate {
add_field => { "read_timestamp" => "%{@timestamp}" }
}
date {
match => [ "[time]", "dd/MMM/YYYY:H:m:s Z" ]
remove_field => "[time]"
}
useragent {
source => "[agent]"
target => "[user_agent]"
remove_field => "[agent]"
}
}
output {
file {
path => "/media/transformed/accessout.json"
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment