ini 用于Syslog输入的Logstash Conf Filter

Posted 2021-05-24

## https://github.com/minyk/morphline-mr/wiki/DictionariesOfGrok
## https://serverfault.com/questions/735230/why-cant-the-logstash-syslog-pri-filter-see-the-priority-in-syslog-messages

filter {
  if [type] == "syslog" {
    grok {
      match => {
      "message" => [ "%{SYSLOG5424PRI}%{SYSLOGBASE2}", "%{SYSLOGBASE2}", "%{SYSLOGPAMSESSION}", "%{CRONLOG}", "%{SYSLOGLINE}" ]
      }
      tag_on_failure => [ "failedPattern_syslog" ]
      add_field    => [ "received_at", "%{@timestamp}" ]
### kafka plugin tak bawa host ###    add_field    => [ "received_from", "%{host}" ]
      add_tag => [ "syslog" ]
    }

### sso ### 2018-05-02T01:00:17+08:00

    date {
      locale => "en"
      timezone => "Asia/Kuala_Lumpur"
      match => ["timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
      remove_field => ["timestamp"]
    }

    date {
      locale => "en"
      timezone => "Asia/Kuala_Lumpur"
      match => ["timestamp8601", "ISO8601"]
      remove_field => ["timestamp8601"]
    }

    syslog_pri { 
   syslog_pri_field_name => "syslog5424_pri"
   }

  }
}