openstack
/
logstash-filters
Code Issues Proposed changes

Handle the new journald based logs 

These logs have slightly more information. Also they have syslog
timestamps not iso8601 timestamps.

Change-Id: I7eaa35b3259d17f7e1f5f69e5acf41bddec685f7
This commit is contained in:
Clark Boylan 2017-05-03 10:42:42 -07:00
parent d33c95310d
commit 9e1dd3b7e1
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
filters/openstack-filters.conf
View File

@ -22,7 +22,7 @@ filter {
} else if "oslofmt" in [tags] { } else if "oslofmt" in [tags] {
multiline { multiline {
negate => true negate => true
pattern => "^%{TIMESTAMP_ISO8601} " pattern => "^(%{TIMESTAMP_ISO8601}|%{SYSLOGTIMESTAMP}) "
what => "previous" what => "previous"
stream_identity => "%{host}.%{filename}" stream_identity => "%{host}.%{filename}"
} }
@ -35,7 +35,7 @@ filter {
# NUMBER being required element here is important, otherwise # NUMBER being required element here is important, otherwise
# ERROR messages just fold into the previous messages, which are # ERROR messages just fold into the previous messages, which are
# typically INFO. # typically INFO.
pattern => "^%{TIMESTAMP_ISO8601}%{SPACE}%{NUMBER}%{SPACE}(TRACE|ERROR)" pattern => "^(%{TIMESTAMP_ISO8601}|%{SYSLOGTIMESTAMP})%{SPACE}%{NUMBER}%{SPACE}(TRACE|ERROR)"
what => "previous" what => "previous"
stream_identity => "%{host}.%{filename}" stream_identity => "%{host}.%{filename}"
} }
@ -43,7 +43,7 @@ filter {
# Do multiline matching as the above mutliline filter may add newlines # Do multiline matching as the above mutliline filter may add newlines
# to the log messages. # to the log messages.
# TODO move the LOGLEVELs into a proper grok pattern. # TODO move the LOGLEVELs into a proper grok pattern.
match => { "message" => "(?m)^%{TIMESTAMP_ISO8601:logdate}%{SPACE}%{NUMBER:pid}?%{SPACE}?(?<loglevel>AUDIT|CRITICAL|DEBUG|INFO|TRACE|WARNING|ERROR) \[?\b%{NOTSPACE:module}\b\]?%{SPACE}?%{GREEDYDATA:logmessage}?" } match => { "message" => "(?m)^(%{TIMESTAMP_ISO8601:logdate}|%{SYSLOGTIMESTAMP:logdate})%{SPACE}(%{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?:|%{NUMBER:pid})?%{SPACE}?(?<loglevel>AUDIT|CRITICAL|DEBUG|INFO|TRACE|WARNING|ERROR) \[?\b%{NOTSPACE:module}\b\]?%{SPACE}?%{GREEDYDATA:logmessage}?" }
add_field => { "received_at" => "%{@timestamp}" } add_field => { "received_at" => "%{@timestamp}" }
} }
} else if "apachecombined" in [tags] { } else if "apachecombined" in [tags] {