sewox
May 30, 2018, 8:01am
1
Hi Everyone,
Parser File ->
@module mod-java
filter f102181 { netmask("10.21.8.1/32")};
destination d102181 {
file("/var/log/zamanbaz/Hot/10.21.8.1.log" template("${HOUR}:${MIN}:${SEC} ${TZ}|${HOST}|${FACILITY}|${LEVEL}|${MESSAGE}\n") template-escape(no) create-dirs(yes) dir_owner("root") dir_group("root") dir_perm(0640) owner("root") group("root") perm(0640));
};
log { source(zamanbaz); filter(f102181); destination(d102181); };
rewrite r102181_rewrite_subst{
subst("src_mac=00: 0:00: 0:00: 0", "src_mac=00:00:00:00:00:00", value("MESSAGE"), flags("global"));
subst(" ", " ", value("MESSAGE"), flags("global"));
set("$MESSAGE Source.DevType=Sophos", value("MESSAGE"));
subst("date","Source.Date", value("MESSAGE"));
subst("time","Source.Time", value("MESSAGE"));
subst("timezone","Source.TimeZone", value("MESSAGE"));
show original
{
"index_patterns": ["useroam_*"],
"settings": {
"number_of_replicas": "0",
"number_of_shards": "1",
"codec": "best_compression",
"refresh_interval": "60s",
"requests": {
"cache": {
"enable": "true"
}
}
},
"mappings": {
"Loglar": {
"numeric_detection": false,
"date_detection": true,
"properties": {
"AP": {
show original
where is the problem, parse file or template file ???
system
June 27, 2018, 8:02am
2
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.