logstash接受checkpoint防火墙日志并用ruby分词

Posted 2021-06-18 带着泥土

直接上logstahs配置文件

input{
    syslog{
    type => "syslog"
    port => 514
    }
}
filter {
    grok {
      match => {
                "message" => "\\[%{DATA:log}\\"\\]"
         }
}
    ruby {
                code => "
                        array1 = event.get(\'log\').split(%r{\\";\\s})
                        array1.each do |temp1|
                                if temp1.nil? then
                                        next
                                end
                                array2 = temp1.split(\':\')
                                key = array2[0]
                                value = array2[1]
                                if key.nil? then
                                        next
                                end
                                event.set(key, value)
                        end
                "
                remove_field => [ "log" ]
        }
}
output {
    elasticsearch {
        hosts => "elastic:9200"
        user => "elastic"
        password => "*****"
        index => "smc-%{+yyyy.MM.dd}"
        }
}