i'm trying read log of apache_Access and apache_error, those are remote log, when i insert, logstash read again the file and insert agin the entries.
My configuracion file of logstash:
input {
file{
path => "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/log_aceso/accesso"
type => "apache_access"
}
file{
path => "/home/clusterelastic/cluster/nodo1/logstash-5.5.2/logsaleer/log_error/error"
type => "apache_error"
}
filter {
if [type] in [ "apache" , "apache_access" , "apache-access" ,"access"] {
grok {
match => ["message"," %{IP:clientip} - - [%{NOTSPACE:date} -%{INT}] "%{WORD:action} /%{WORD}/%{WORD}/%{NOTSPACE:login} %{WORD:protocol}/%{NUMBER:protocolNum}" %{NUMBER:status} %{NUMBER} "%{NOTSPACE}" "%{NOTSPACE:client} (%{WORD}; %{WORD:clientOs}%{GREEDYDATA}"]
}
}
if [type] in ["apache_error","apache-error","error_log"] {
grok {
match => ["message", "[%{DATA:DAY} %{DATA:MONTH} %{DATA:year} : %{DATA:HOUR}] [\php5:%{LOGLEVEL:loglevel}] [pid %{POSINT:pid}]( [client %{IP:client}:%{POSINT:clientport}]) %{GREEDYDATA:message}"]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
stdout { codec => rubydebug }
}