- Debug pipeline:
input {
pipeline {
address => apache2
}
}
filter {
grok {
match => { "message" => '\*\*(?<response_time>[^/]+)%{DATA:after_double_star}\*\*' }
}
grok {
match => [
"message" , "%{COMBINEDAPACHELOG}"
]
}
if [response_time] {
mutate {
convert => { "response_time" => "integer" }
}
}
}
output {
elasticsearch {
hosts => [ 'localhost:9200' ]
index => "apache2-%{+YYYY-MM-dd}"
}
if [host][hostname] == 'xxxxxx-xxxxxx' {
file {
path => "/tmp/debug.log"
codec => rubydebug
}
}
}