[英]ELK LDAP log filtering
Two things: Our logs look like this - 两件事:我们的日志如下所示-
May 11 06:51:31 ldap slapd[6694]: conn=1574001 op=1 SRCH base="cn=s_02,ou=users,o=meta" scope=0 deref=0 filter="(...)"
I need to 1) take the time stamp and set it to the left column "time" in Kibana's discover panel and 2) take the number after connection and make it a field so as to be able to order them by number.
input { file { path => "/Desktop/logs/*.log" type => "log" sincedb_path => "/dev/null" } } output { elasticsearch { hosts => "127.0.0.1" index => "logstash-%{type}-%{+YYYY.MM.dd}" } file { path => "/home/logsOut/%{type}.%{+yyyy.MM.dd.HH.mm}" } }
If you only need these two as seperate fields: 如果只需要将这两个字段作为单独的字段:
filter {
grok {
match => {
"message" => [ "%{SYSLOGBASE} conn=%{INT:conn}" ]
}
}
date {
match => [ "timestamp", "MMM dd HH:mm:ss" ]
target => "time"
}
mutate {
convert => { "conn" => "integer" }
}
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.