Hi,
I have done with mutate+gsub. ut it seems like after the replacement that particular parameter ("localtime") doesn't detects as a parameter in date format. Is there a workaround that I can perform. Below is my logstash,conf
input {
beats {
type => "proxy_bluecoat"
port => 5044
}
}
filter {
if [type] == "proxy_bluecoat" {
# drop comment lines
if ([message] =~ /^#/) {
drop{}
}
csv {
columns => ["para1","para2", "para3", "para4", "localtime", "time_taken", "c_ip", "cs_username", "cs_auth_group", "x_exception_id", "sc_filter_result", "cs_categories", "cs_referer", "sc_status", "s_action", "cs_method", "rs_content_type", "cs_uri_scheme", "cs_host", "cs_uri_port", "cs_uri_path", "cs_uri_query", "cs_uri_extension", "cs_user_agent", "s_ip", "sc_bytes", "cs_bytes", "x_virus_id", "x_bluecoat_application_name", "x_bluecoat_application_operation", "x_bluecoat_application_groups", "cs_threat_risk", "r_ip"]
separator => " "
}
mutate {
gsub => [
"localtime", "0550", "0530",
]
}
if [localtime] {
date {
match => ["localtime", "[dd/MMM/YYYY:HH:mm:ss Z]"]
}
}
if ([r-ip] and [r-ip] != "-") {
geoip {
source => "r-ip"
}
}
mutate {
convert => ["sc_bytes", "integer",
"time_taken", "integer",
"r_port", "integer",
"s_port", "integer",
"cs_bytes", "integer",
"duration", "integer",
"cs_threat_risk", "integer"
]
}
if [cs_user_agent] != "" {
useragent { source => "cs_user_agent" prefix => "user_agent." }
}
if ([cs_categories] and [cs_categories] != "" and [cs_categories] != "-") {
mutate {
split => { "cs_categories" => ";" }
}
}
mutate {
remove_field => ["message", "host", "date", "time", "timestamp", "gmttime", "para1", "para2", "para3", "para4"]
}
}
}
output {
if [type] == "proxy_bluecoat" {
#stdout { codec => rubydebug }
elasticsearch {
index => "syslogs-%{[type]}-%{+YYYY.MM.dd}"
hosts => ["elasticsearch:9200"]
#index => "logstash-%{[type]}-%{+YYYY.MM.dd}"
}
}
}