hi my mission it is to monitor a Blackberry (BES) Server with logstash
i got 3 types of Logfiles on BES-Server to parse,
core, mdat and disp logfile-types,
but they save wrong into ES,
with 2 types it was more easier,
but now with 3,
i dont know how to solve the prob,
someone can help pls?
logstash:
input {
lumberjack {
# The port to listen on
port => 5000
# The paths to your ssl cert and key
ssl_certificate => "/opt/logstash/etc/log.x.crt"
ssl_key => "/opt/logstash/etc/logstash.key"
}
}
filter {
if [type] == "bb_core" {
grok {
match => { "message" => "\A%{TIMESTAMP_ISO8601}%{SPACE}%{NOTSPACE}%{SPACE}%{PROG:cLevel} {%{SYSLOG5424PRINTASCII:cThread} : %{WORD:cQUEUE}} %{SYSLOG5424PRINTASCII:cNone} %{SYSLOG5424PRINTASCII:cCorrelation} - %{PROG:cStatus} %{GREEDYDATA:cMessage}" }
}
if "_grokparsefailure" in [tags] {
mutate {
type => "bb_disp" }
}
}
if [type] == "bb_disp" {
grok {
match => { "message" => "\A<#%{INT:dRautenID}>[%{INT}] (%{NOTSPACE:dDate} %{HAPROXYTIME:dTIME}%{NOTSPACE:dID2} {%{JAVAFILE:dUsername}} %{CISCO_REASON:dAction}(%{WORD}%{NOTSPACE} %{NOTSPACE:dID}%{SPACE}%{WORD}=%{NOTSPACE:dEmail} %{HOST}=%{WORD:dDeviceID};%{UUID:dCorrelation}, %{WORD}=%{WORD:dRouting}, %{USER}=<%{WORD:dAgent}>, %{USER}=%{WORD:dTime}, %{WORD}=%{INT:dExt}, %{WORD}=%{INT:dwl}%{NOTSPACE}%{SPACE}%{GREEDYDATA:dMessage}"}
}
if "_grokparsefailure" in [tags] {
mutate {
type => "bb_mdat" }
}
}
if [type] == "bb_mdat" {
grok {
match => { "message" => "\A<%{TIMESTAMP_ISO8601}%{SPACE}%{WORD}>:[%{INT:mID}]:<%{USERNAME:mDOMAIN}>:<%{WORD:mAction}>:<%{WORD:mLayer} = %{WORD:mLayerinfo}, %{GREEDYDATA:mMessage}"}
}
}
if "_grokparsefailure" in [tags] {
mutate {
type => "bb_core" }
}
}
output {
if "_grokparsefailure" not in [tags] {
elasticsearch { host => localhost }
stdout { codec => rubydebug } } }
forwarder:
{
"network": {
"servers": [ "log.x:5000" ],
"ssl ca": "/opt/logstash-forwarder/etc/log.x.crt",
"timeout": 15
},
"files": [
{
"paths": [
"/var/log/bbx1.log"
],
"fields": { "type": "bb_core" }
},
{
"paths": [
"/var/log/bbx1.log"
],
"fields": { "type": "disp" }
},
{
"paths": [
"/var/log/bbx1.log"
],
"fields": { "type": "bb_mdat" }
}
]
}
