Nagios Log Server - useragent logstash plugin
Posted: Wed Aug 30, 2017 12:14 pm
I'm attempting to use this logstash plugin, I'm assuming it's enabled. I've got my Apache logs coming in in varios ways, my IIS logs are coming in via EventLogging. I've got the following filters set up but I don't see any fields or data being generated by the useragent plugin. Any ideas on how to get this working?
Code: Select all
#
# Logstash Configuration File
# Dynamically created by Nagios Log Server
#
# DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN.
#
# Created Wed, 30 Aug 2017 13:12:03 -0400
#
#
# Global filters
#
filter {
if [program] == 'apache_access' {
grok {
match => [ 'message', '%{COMMONAPACHELOG}']
}
date {
match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z', 'MMM dd HH:mm:ss', 'ISO8601' ]
}
mutate {
replace => [ 'type', 'apache_access' ]
convert => [ 'bytes', 'integer' ]
convert => [ 'response', 'integer' ]
}
}
if [program] == 'apache_custom' {
grok {
match => [ 'message', '%{CUSTOMAPACHELOG}']
}
date {
match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z', 'MMM dd HH:mm:ss', 'ISO8601' ]
}
mutate {
replace => [ 'type', 'apache_custom' ]
convert => [ 'bytes', 'integer' ]
convert => [ 'response', 'integer' ]
}
}
if [program] == 'apache_combined' {
grok {
match => [ 'message', '%{COMBINEDAPACHELOG}']
}
date {
match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z', 'MMM dd HH:mm:ss', 'ISO8601' ]
}
mutate {
replace => [ 'type', 'apache_combined' ]
convert => [ 'bytes', 'integer' ]
convert => [ 'response', 'integer' ]
}
}
if [program] == 'apache_error' {
grok {
match => [ 'message', '%{HTTPD20_ERRORLOG}']
}
mutate {
replace => [ 'type', 'apache_error' ]
}
}
if [SourceName] == 'Microsoft-Windows-IIS-Logging' {
useragent {
source => 'csUser-Agent'
}
}
if [program] == 'apache_access' {
useragent {
source => 'agent'
}
}
if [program] == 'apache_combined' {
useragent {
source => 'agent'
}
}
if [program] == 'apache_custom' {
useragent {
source => 'agent'
}
}
if [program] == 'apache_error' {
useragent {
source => 'agent'
}
}
}
#
# Local filters
#