Lastly, I have a config file that establishes log's origin:
##########
# Mutate Parameters - City Name
##########
filter {
if [host] =~ /10\.1\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Memphis" ] }
}
else if [host] =~ /10\.2\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Jackson" ] }
}
else if [host] =~ /10\.3\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Nashville" ] }
}
else if [host] =~ /10\.4\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Chattanooga" ] }
}
else if [host] =~ /10\.5\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Knoxville" ] }
}
else if [host] =~ /10\.7\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Johnson City" ] }
}
else if [host] =~ /10\.8\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Washington" ] }
}
else if [host] =~ /10\.10\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Birmingham" ] }
}
else if [host] =~ /10\.11\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "New Orleans" ] }
}
else if [host] =~ /10\.12\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Mandeville" ] }
}
else if [host] =~ /10\.13\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Baton Rouge" ] }
}
else if [host] =~ /10\.14\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "East Memphis" ] }
}
else if [host] =~ /10\.15\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Montgomery" ] }
}
else if [host] =~ /10\.16\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Macon" ] }
}
else if [host] =~ /10\.17\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Houston" ] }
}
else if [host] =~ /10\.18\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Orlando" ] }
}
else if [host] =~ /10\.19\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Fort Lauderdale" ] }
}
else if [host] =~ /10\.20\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Memphis Lab" ] }
}
else if [host] =~ /10\.21\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Knoxvile Lab" ] }
}
else if [host] =~ /10\.22\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Tallahassee" ] }
}
else if [host] =~ /10\.23\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Jacksonville" ] }
}
else if [host] =~ /10\.24\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Columbia" ] }
}
else if [host] =~ /10\.25\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Atlanta" ] }
}
else if [host] =~ /10\.26\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Baltimore" ] }
}
else if [host] =~ /10\.27\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "City Center" ] }
}
else if [host] =~ /10\.28\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Towson" ] }
}
else if [host] =~ /10\.92\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Home Router" ] }
}
else if [host] =~ /10\.101\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Atlanta" ] }
}
else if [host] =~ /10\.102\.([0-9]{1,3})/ {
mutate { add_field => [ "city", "Scottsdale" ] }
}
else {
mutate { add_field => [ "city", "Unknown" ] }
}
}
##################################################
Finally, the outputs:
Localhost is only enabled if I am doing some local debugging of some sort.
##########
# ELASTICSAERCH Output Parameters (Localhost)
##########
#output {
# elasticsearch {
# hosts => ["http://localhost:9200"]
# index => "logstash-%{+YYYY.MM.dd}"
# }
# stdout { codec => rubydebug }
#}
##################################################
First data center cluster target:
##########
# ELASTICSAERCH Output Parameters
##########
output {
elasticsearch {
hosts => ["http://xxx.xxx.xxx.xxx:9200","http://xxx.xxx.xxx.xxx:9200","http://10.1.51.103:9200"]
index => "logstash-%{+YYYY.MM.dd}"
}
# stdout { codec => rubydebug }
}
##################################################
Second data center target:
##########
# ELASTICSAERCH Output Parameters
##########
output {
elasticsearch {
hosts => ["http://xxx.xxx.xxx.xxx:9200","http://xxx.xxx.xxx.xxx:9200","http://10.5.51.103:9200"]
index => "logstash-%{+YYYY.MM.dd}"
}
# stdout { codec => rubydebug }
}
##################################################