logstash.conf_23.02.20

grok 패턴의 다양성을 위해서 config 설정 변경 시 내용 공유 합니다.

샘플로 이용을 해주시면 좋을 것 같아요.

설정 중 더 나은 코드 정보가 있으면 의견도 부탁드립니다.

 

input {
	file {
		path => "/var/log/rsyslog/192.168.10.2/*.log"
		start_position => "beginning"
		tags => ["ap1"]
	}
	file {
		path => "/var/log/rsyslog/192.168.10.3/*.log"
		start_position => "beginning"
		tags => ["ap2"]
	}
	file {
		path => "/var/log/rsyslog/192.168.10.4/*.log"
		start_position => "beginning"
		tags => ["ap3"]
	}
	file {
		path => "/var/log/rsyslog/192.168.10.5/*.log"
		start_position => "beginning"
		tags => ["ap4"]
	}
}

filter {
	if "ap1" in [tags] or "ap2" in [tags] or "ap3" in [tags] or "ap4" in [tags]  {
		grok {
			patterns_dir => ["/etc/logstash/pattern.d"]
				match => {
					"message" => [
						"%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{IPORHOST:process}\[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}",
						"%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} \[%{BASE10NUM:process_id}\]\: %{GREEDYDATA:sub_message}",
						"%{SYSLOGTIMESTAMP:access_time} %{IPORHOST:ip_or_host} %{WORD:process}\: User\: %{USER:User} %{GREEDYDATA:Reason} in %{GREEDYDATA:access_day}\#%{NUMBER:Deauthentication_Reason_Code}, to %{IP:Destination_IP}, from %{IP:Start_ip} using %{WORD:Access_Method}"
					]
				}
		}
		mutate { remove_field => [ "message" ] }
	}
}

output {
	if "ap1" in [tags] {
		elasticsearch {
			hosts => ["http://192.168.0.17:9200"]
			index => "logstash-ap1-index-%{+YYYY.MM.dd}"
		}
	}
	else if "ap2" in [tags] {
		elasticsearch {
			hosts => ["http://192.168.0.17:9200"]
			index => "logstash-ap2-index-%{+YYYY.MM.dd}"
		}
	}
	else if "ap3" in [tags] {
		elasticsearch {
			hosts => ["http://192.168.0.17:9200"]
			index => "logstash-ap3-index-%{+YYYY.MM.dd}"
		}
	}
	else if "ap4" in [tags] {
		elasticsearch {
			hosts => ["http://192.168.0.17:9200"]
			index => "logstash-ap4-index-%{+YYYY.MM.dd}"
		}
	}
}