Hi guys!
during the last days I've been reading documentation in order to get my apache logs imported in different indexes based on the date of the log entries. With the configuration below I got it running with indexes like "index_period_2016dec". Now I would like to go further and get the number of the month instead of the name, so it is easier to sort the different indexes.
My two questions are:
- is "correct" the way I did it with the whole regexp for grok? are there any other ways to do this in a simpler way?
- how do I got the month (string) translated to its number?
filter {
if [type] == "apache-access" {
grok {
match => [ "message", '%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[(?<timestamp>%{MONTHDAY}/%{MONTH:auxmonth}/%{YEAR:auxyear}:%{TIME} %{INT})\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}']
}
date {
locale => "en"
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
}
mutate {
lowercase => [ "auxmonth" ]
}
}
}
output {
if [request] =~ /(\.ova)|(\.qc2)|(\.rpm)|(\.gz)|(\.bz2)|(\.deb)$/ {
if [response] =~ /^2\d\d/ {
elasticsearch {
hosts => ["elasticsearch:443"]
ssl => true
ssl_certificate_verification => false
path => "data"
user => "myuser"
password => "****"
index => "index_period_%{auxyear}%{auxmonth}"
manage_template => false
workers => 5
document_type => "items"
}
}
}
}
