Commit f545df43 authored by Roman Kiš's avatar Roman Kiš
Browse files

init

parents
version: '3'
services:
logspout:
image: gliderlabs/logspout:v3
command: 'syslog://logstash:5000'
links:
- logstash
volumes:
- '/var/run/docker.sock:/tmp/docker.sock'
logstash:
image: logstash:5
command: 'logstash -f /logstash.conf -e'
links:
- elasticsearch
volumes:
- ./logstash.conf:/logstash.conf
environment:
- LOGSPOUT=ignore
elasticsearch:
image: elasticsearch:5
environment:
- LOGSPOUT=ignore
kibana:
image: kibana:5
links:
- 'elasticsearch'
ports:
- '5601:5601'
environment:
- LOGSPOUT=ignore
input {
syslog {
port => 5000
type => "docker"
}
}
filter {
grok {
match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:ver} +(?:%{TIMESTAMP_ISO8601:ts}|-) +(?:%{HOSTNAME:service}|-) +(?:%{NOTSPACE:containerName}|-) +(?:%{NOTSPACE:proc}|-) +(?:%{WORD:msgid}|-) +(?:%{SYSLOG5424SD:sd}|-|) +%{GREEDYDATA:msg}" }
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
mutate {
remove_field => [ "message", "priority", "ts", "severity", "facility", "facility_label", "severity_label", "syslog5424_pri", "proc", "syslog_severity_code", "syslog_facility_code", "syslog_facility", "syslog_severity", "syslog_hostname", "syslog_message", "syslog_timestamp", "ver" ]
}
mutate {
remove_tag => [ "_grokparsefailure_sysloginput" ]
}
mutate {
gsub => [
"service", "[0123456789-]", ""
]
}
if [msg] =~ "^ *{" {
json {
source => "msg"
}
if "_jsonparsefailure" in [tags] {
drop {}
}
mutate {
remove_field => [ "msg" ]
}
}
if ("" in [msg]) {
mutate {
rename => { "msg" => "message" }
}
}
mutate {
remove_field => [ "tags" ]
}
}
output {
elasticsearch {
hosts => "elasticsearch:9200"
}
}
\ No newline at end of file
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment