Last active
February 7, 2017 12:23
-
-
Save seidler2547/38f1c927a85ea45ddf575ee54da6bd3e to your computer and use it in GitHub Desktop.
rsyslog to Elasticsearch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # monthly syslog indices | |
| template(name="logstash-index" | |
| type="list") { | |
| constant(value="logstash-syslog-") | |
| property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4") | |
| constant(value=".") | |
| property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7") | |
| } | |
| # most data we can get | |
| template(name="json-syslog" | |
| type="list" | |
| option.json="on") { | |
| constant(value="{") | |
| constant(value="\"@timestamp\" :\"") property(name="timereported" dateFormat="rfc3339") | |
| constant(value="\",\"sysloghost\" :\"") property(name="hostname") | |
| constant(value="\",\"severity\" :\"") property(name="syslogseverity-text") | |
| constant(value="\",\"facility\" :\"") property(name="syslogfacility-text") | |
| constant(value="\",\"raw_tag\" :\"") property(name="syslogtag") | |
| constant(value="\",\"program\" :\"") property(name="programname") | |
| constant(value="\",\"app\" :\"") property(name="app-name") | |
| constant(value="\",\"source\" :\"") property(name="inputname") | |
| constant(value="\",\"pid\" :\"") property(name="procid") | |
| constant(value="\",\"message\" :\"") property(name="msg") | |
| constant(value="\",\"raw_message\" :\"") property(name="rawmsg") | |
| constant(value="\",\"type\" :\"rsyslog") | |
| constant(value="\"}") | |
| } | |
| # send to ES | |
| action(type="omelasticsearch" | |
| server="localhost" | |
| template="json-syslog" | |
| searchIndex="logstash-index" | |
| dynSearchIndex="on") |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # monthly syslog indices | |
| template(name="logstash-index" | |
| type="list") { | |
| constant(value="logstash-syslog-") | |
| property(name="timereported" dateFormat="rfc3339" position.from="1" position.to="4") | |
| constant(value=".") | |
| property(name="timereported" dateFormat="rfc3339" position.from="6" position.to="7") | |
| } | |
| # all the data that might be useful | |
| template(name="json-syslog" | |
| type="list" | |
| option.json="on") { | |
| constant(value="{") | |
| constant(value="\"@timestamp\" :\"") property(name="timereported" dateFormat="rfc3339") | |
| constant(value="\",\"sysloghost\" :\"") property(name="hostname") | |
| constant(value="\",\"severity\" :\"") property(name="syslogseverity-text") | |
| constant(value="\",\"facility\" :\"") property(name="syslogfacility-text") | |
| constant(value="\",\"raw_tag\" :\"") property(name="syslogtag") | |
| constant(value="\",\"program\" :\"") property(name="programname") | |
| constant(value="\",\"app\" :\"") property(name="app-name") | |
| constant(value="\",\"source\" :\"") property(name="inputname") | |
| constant(value="\",\"pid\" :\"") property(name="procid") | |
| constant(value="\",\"message\" :\"") property(name="msg") | |
| constant(value="\",\"raw_message\" :\"") property(name="rawmsg") | |
| constant(value="\",\"hostname\" :\"<%= @fqdn %>") | |
| constant(value="\",\"type\" :\"rsyslog") | |
| constant(value="\"}") | |
| } | |
| # send to ES | |
| action( type="omelasticsearch" | |
| server="<%= @logserver %>" | |
| template="json-syslog" | |
| searchIndex="logstash-index" | |
| dynSearchIndex="on" | |
| bulkmode="on" | |
| queue.type="linkedlist" | |
| queue.size="5000" | |
| queue.dequeuebatchsize="30" | |
| action.resumeretrycount="-1") |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment