Skip to content

Instantly share code, notes, and snippets.

@postwait

postwait/gist:5509169

Created May 3, 2013 13:42
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save postwait/5509169 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save postwait/5509169 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
grok {
type => "syslog"
pattern => [ "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} (%{SYSLOGHOST:syslog_hostname} )?%{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?:(?: \[ID\s%{DATA:syslog_msgid}\])? %{GREEDYDATA:syslog_message}" ]
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{@source_host}" ]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment