| #!/usr/bin/env bash | |
| set -euo pipefail | |
| FILENAME=${1?"Must specify filename"} | |
| OUTPUT=${2?"Must specify output file"} | |
| TYPE=$(ffprobe -v error -select_streams v:0 -show_entries stream=codec_name -of default=noprint_wrappers=1:nokey=1 "${FILENAME}") | |
| if [ "${TYPE}" == "vc1" ]; then |
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| FILENAME=${1?"Must specify filename as first arg"} | |
| if od -A x -t x1 -v "$FILENAME" | grep -Eqe " 0[1-8bcef]| 1[0-9a-f]"; then | |
| echo "$FILENAME: data" | |
| fi |
| +-------------------------+ | |
| | | +-------------------+ | |
| | | +---^+ HAWT | | |
| | http://asciiflow.com/ | | | | | |
| | | | +-------------------+ | |
| | +----+ | |
| +-------------------------+ |
| > docker run logstash:latest plugin install logstash-filter-extractnumbers | |
| Validating logstash-filter-extractnumbers | |
| Installing logstash-filter-extractnumbers | |
| Installation successful |
| #!/usr/bin/env python3 | |
| output = ["%s%s" % (" "*(9-i), "".join(str(num) for num in list(range(1, i+1)) + list(range(1, i+1))[-2::-1])) for i in range(1, 10)] | |
| print("\n".join(output + output[-2::-1])) |
| function workremote -d "Set up the necessary remote tunnels" | |
| echo Setting up SOCKS Proxy | |
| sudo networksetup -setproxybypassdomains Wi-Fi 169.254/16 *.com *.org *.co | |
| sudo networksetup -setsocksfirewallproxy Wi-Fi 127.0.0.1 5000 off | |
| sudo networksetup -setsocksfirewallproxystate Wi-Fi on | |
| echo Tunneling to Work | |
| ssh -L 5222:hipchat.internal:5222 -L 5223:hipchat.internal:5223 remote_host -N -D 5000 & | |
| read -p 'set_color green; echo read; set_color normal; echo "enter to quit> "' | |
| echo Closing Tunnel | |
| kill -9 %ssh\ -L\ 5222:hipchat.internal:5222\ -L\ 5223:hipchat.internal:5223\ remote_host\ -N\ -D\ 5000\ \& |
Ingesting last year's syslog loglines will use this year's year since syslog format doesn't have a year in it (SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}). I'm reading in the syslog lines from the file input and am still playing around with ES config, so I'm constantly DELETEing indexes, so I need to keep re-importing. This isn't a production-style solution.
I'm currently processing the timestamp pulled out with the syslog pattern using the date filter
date {
| POST /pindrop/_search HTTP/1.1 | |
| Content-Type: application/json | |
| Host: logstash.local:9200 | |
| Connection: close | |
| User-Agent: Paw/2.1.1 (Macintosh; OS X/10.10.2) GCDHTTPRequest | |
| Content-Length: 209 | |
| { | |
| size: 0, | |
| "aggregations" : { |
| input { | |
| stdin {} | |
| } | |
| filter { | |
| grok { | |
| # Ex: I AM SOME DATA | |
| match => ["message", "^%{DATA}$"] | |
| } | |
| if [data][info][score][value] { |
| #!/usr/local/bin/python3 | |
| import urllib.request | |
| import json | |
| import sys | |
| import os | |
| URL = 'http://0.0.0.0:9200/_stats' | |
| # COUNT_FILE = os.environ['HOME'] + '/tmp/es_count.tmp' | |
| # COUNT_OUTPUT = os.environ['HOME'] + '/tmp/es_output.tmp' | |
| COUNT_FILE = '/Users/cmoultrie/tmp/es_count.tmp' |