poolski

# /etc/elasticsearch/elasticsearch.yml
#
# Remember the cluster name if you ever add extra nodes
cluster.name: logstash
# If you leave node.name blank, it'll autogenerate a node name each time you start ES, picking from 3000 marvel comicbook heroes. 
node.name: "log-indexer"
node.master: true
node.data: true

# Set the bind address specifically (IPv4 or IPv6)

poolski

{
  "network": {
    "servers": [ "10.0.0.10:5043" ],
    "ssl certificate": "/etc/logstashforwarder/ssl/logstashforwarder.crt",
    "ssl ca": "/etc/logstashforwarder/ssl/ca.crt",
    "ssl key": "/etc/logstashforwarder/ssl/logstashforwarder.key",
    "timeout": 15
  },
  "files": [
    {

poolski

# Syslog stuff
COMPONENT ([\w._\/%-]+)
COMPID postfix\/%{COMPONENT:component}(?:\[%{POSINT:pid}\])?
POSTFIX %{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:hostname} %{COMPID}: %{QUEUEID:queueid}

# Milter
HELO (?:\[%{IP:helo}\]|%{HOST:helo}|%{DATA:helo})

MILTERCONNECT %{QUEUEID:qid}: milter-reject: CONNECT from %{RELAY:relay}: %{GREEDYDATA:milter_reason}; proto=%{WORD:proto}
MILTERUNKNOWN %{QUEUEID:qid}: milter-reject: UNKNOWN from %{RELAY:relay}: %{GREEDYDATA:milter_reason}; proto=%{WORD:proto}

poolski

---
  beats::filebeat::prospectors: 
    authlog: 
      fields: 
        type: "authlog"
      paths: 
        - "/var/log/auth.log"
    syslog: 
      fields: 
        type: "syslog"

poolski

Keybase proof

I hereby claim:

• I am poolski on github.
• I am poolski (https://keybase.io/poolski) on keybase.
• I have a public key ASAWL03Y3Y7s4DG5vXEtjnHqkuPSlZVjsqggFm__HBzQBAo

To claim this, I am signing this object:

poolski

Tumblr user geekdawson:

one of the more valuable things I’ve learned in life as a survivor of a mentally unstable parent is that it is likely that no one has thought through it as much as you have.

no, your friend probably has not noticed they cut you off four times in this conversation.

no, your brother didn’t realize his music was that loud while you were studying.

no, your bff or S.O. doesn’t remember that you’re on a tight deadline right now.

poolski

---
# Envoy requires this to be configured, even if you don't intend to use the admin interface.
admin:
  access_log_path: "/var/log/envoy/envoy-admin.log"
  address:
    socket_address:
      address: 127.0.0.1
      port_value: 8001
# Identify your node/pod/instance/whatever.
node:

poolski

{
  "y_axis": {
    "format": "currency",
    "unit": "USD"
  },
  "series": [
    {
      "name": "GBP -> USD",
      "data": [
        1.62529,