input {
gelf {
port => 12201
}
}
filter {
mutate {
add_field => { "environment" => "${ENVIRONMENT}" }
add_tag => [ "%{tag}" ]
}
if "backend" in [tags] {
json {
source => "message"
skip_on_invalid_json => "false"
add_field => { "[@metadata][target_index]" => "epourvoi-app-logs" }
}
if "_jsonparsefailure" in [tags] {
drop { }
}
if "http.log" in [logger] {
mutate {
replace => { "message" => "%{[request][method]} %{[request][uri]} %{status}" }
add_tag => ["caddy"]
add_field => { "[@metadata][target_index]" => "epourvoi-access-logs" }
}
} else {
mutate {
add_tag => ["php"]
add_field => { "[@metadata][target_index]" => "epourvoi-app-logs" }
}
}
}
if "frontend" in [tags] {
}
if "gotenberg" in [tags] {
json {
source => "message"
skip_on_invalid_json => "false"
}
if "_jsonparsefailure" in [tags] {
mutate {
remove_tag => ["_jsonparsefailure"]
}
} else {
mutate {
replace => { "message" => "%{[method]} %{[uri]} %{status}" }
}
}
}
}
output {
if [@metadata][target_index] == "epourvoi-app-logs" {
elasticsearch {
hosts => ["${ELASTIC_HOST}"]
user => "${ELASTIC_USERNAME}"
password => "${ELASTIC_PASSWORD}"
ssl_enabled => false
index => "%{[@metadata][target_index]}-%{+YYYY.MM.dd}"
}
} else if [@metadata][target_index] == "epourvoi-access-logs" {
elasticsearch {
hosts => ["${ELASTIC_HOST}"]
user => "${ELASTIC_USERNAME}"
password => "${ELASTIC_PASSWORD}"
ssl_enabled => false
index => "%{[@metadata][target_index]}-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
}
the logsstash log
[2024-12-19T15:36:08,363][WARN ][logstash.filters.json ][main][ebb1e4beaf9014f830aaf79bd3fa7b1a04e148ac983e364bb1175e9ac9d6a8df] Error parsing json {:source=>"message", :raw=>"2024/12/19 15:36:08.257\t\e[34mINFO\e[0m\thttp.log.access\tNOP\t{\"request\": {\"remote_ip\": \"10.33.150.2\", \"remote_port\": \"53240\", \"client_ip\": \"150.99.36.14\", \"proto\": \"HTTP/1.1\", \"method\": \"GET\", \"host\": \"\", \"uri\": \"/\", \"headers\": {\"Connection\": [\"Close\"]}}, \"bytes_read\": 0, \"user_id\": \"\", \"duration\": 0.000004851, \"size\": 0, \"status\": 0, \"resp_headers\": {\"Server\": [\"Caddy\"]}}\r", :exception=>#<LogStash::Json::ParserError: Unexpected character ('/' (code 47)): Expected space separating root-level values
at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 6]>}