Nagios Support Forum

Code: Select all

if [LogFile] == '1.log' 
{
	grok 
	{
		match => [ 'message','(?<logTime>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}),\d*\s- activeVehicle=\d+\s+MsgCount\/Hour=\d+\.\d+\s*(?<keyValuePart>.*)']
    }
	
	# parse the date to @timestamp
	date {
        match => ['logTime', 'YYYY-MM-dd HH:mm:ss']
        timezone => "Europe/Berlin"
        remove_field => ['logTime']
    }
	
	
	# clone the event
	clone
	{
		add_tag => [ "cloned" ]
	}

}

Code: Select all

if [type] == 'syslog' {
      clone {
     add_tag => [ "cloned" ]
   }
}

Code: Select all

if [type] == 'syslog' {
      clone {
     clones => [ "clonelog" ]
     add_tag => [ "cloned" ]
   }
}