1.ameba-lib.4.0.source-code.logstash.conf Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of ameba-lib Show documentation

Ameba Utilities

There is a newer version: 4.1.0-jdk17

input {
    file {
        type => "log"
        path => "/tmp/*.log"
        start_position => beginning 
        ignore_older => 0 
        codec => multiline {
            pattern => "^%{WORD:tenant} %{WORD:module} %{TIMESTAMP_ISO8601}"
	    negate => true
            what => previous
        }
    }

    file {
        type => "tsl"
        path => "/tmp/*.tslog"
    }
}


filter {

  if [type] == "log" {
    grok {
      match => { "message" => "%{WORD:tenant} %{WORD:module} %{TIMESTAMP_ISO8601:logDate}\s(%{DATA:requestId})?\s%{WORD:level}\s+\(%{DATA:thread}\) \[%{DATA:classname}\](;%{DATA:msgKey})?(;%{DATA:msgData})? - %{DATA:msgText}$" }
    }
    date {
      match => ["logDate", "YYYY-MM-dd HH:mm:ss.SSS"]
      target => "@timestamp"
    }
  }
  if [type] == "tsl" {
    grok {
      match => { "message" => "%{WORD:tenant} %{WORD:module} %{TIMESTAMP_ISO8601:logDate} (%{DATA:requestId})? \(%{DATA:thread}\) \[%{DATA:classname}\s+\]\s-\s\[.\]%{DATA:direction}\s.*execution\(%{DATA:method}\)\)( took %{NUMBER:timeConsumption:int}\s\[%{DATA:unit}\])?" }
    }
    if [direction] == ">>" {
      drop {}
    }
    date {
      match => ["logDate", "YYYY-MM-dd HH:mm:ss.SSS"] 
      target => "@timestamp"
    }
  }
}
output {
 elasticsearch{
   index => "%{type}_indexer-%{+YYYY.MM.dd}"
 }
 stdout{}
}