I have moved some catalina.out logs from a Production server to the test environment this is where elasticsearch is installed.
I am not able to view the logs. I have set up input/filter/output and I am not seeing the logs. I copied this from an online website.
input {
file {
type => "tomcat"
path => "/home/catalina/logs/audo01.catalina/catalina.out"
}
}
filter {
grok {
match => {
"message" => "%{COMBINEDAPACHELOG} %{IPORHOST:serverip} %{NUMBER:serverport} %{NUMBER:elapsed_millis} %{NOTSPACE:sessionid} %{QS:proxiedip} %{QS:loginame}"
}
overwrite => [ "message" ]
remove_field => [ "ident", "auth" ]
}
useragent {
source => "agent"
target => "ua"
remove_field => [ "agent" ]
}
mutate {
gsub => [
"request", "?.+", "",
"proxiedip", "(^"|"$)", "",
"loginame", "(^"|"$)" , "",
"referrer", "(^"|"$)" , ""
]
}
if [proxiedip] != "-" {
mutate {
replace => {
"clientip" => "%{proxiedip}"
}
}
}
if ![bytes] {
mutate {
add_field => {
"bytes" => "0"
}
}
}
mutate {
remove_field => ["proxiedip"]
}
mutate {
convert => {
"bytes" => "integer"
"elapsed_millis" => "integer"
"serverport" => "integer"
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
output {
if "_grokparsefailure" not in [tags] {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => "112.22.17.66:9200"
}
}
}