ELK学习笔记之F5-HTTP-requesting-logging logstash filter

ELK学习笔记之F5-HTTP-requesting-logging logstash filter

input {tcp {port => 514type => 'f5-request'}}filter {if [type] == "f5-request" {grok {match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:%{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}}geoip {source => "clientip"}}}output {elasticsearch {hosts => ["192.168.214.130:9200"]index => "f5-request-%{+YYYY.MM.dd}"}}

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。