5537e8b378
The geoip capabilities are built into logstash and can help a deployer better understand the workloads they're running within their environments. This change adds geoip capabilities in line with the recommended practice from elastic. Link: https://www.elastic.co/blog/geoip-in-the-elastic-stack Change-Id: I109879bd9aeeaa0312eb3303e2e7566181ecff91 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
24 lines
755 B
Plaintext
24 lines
755 B
Plaintext
filter {
|
|
if "nginx" in [tags] {
|
|
if "nginx-access" in [tags] {
|
|
grok {
|
|
patterns_dir => ['/opt/logstash/patterns']
|
|
match => {
|
|
"message" => "%{IP:client_ip} - %{USER:client_user} \[%{NGINX_TIMESTAMP:timestamp}\] \"%{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:http_version}\" %{INT:response_code} %{INT:bytes} %{QUOTEDSTRING:referer} %{QUOTEDSTRING:user_agent} %{QUOTEDSTRING:gzip_ratio}"
|
|
}
|
|
}
|
|
geoip {
|
|
source => "clientip"
|
|
}
|
|
}
|
|
if "nginx-error" in [tags] {
|
|
grok {
|
|
patterns_dir => ['/opt/logstash/patterns']
|
|
match => {
|
|
"message" => "%{NGINX_ERROR_TIMESTAMP:timestamp} \[%{LOGLEVEL:loglevel}\] %{GREEDYDATA:error_msg}"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|