TuniTour/logstash.conf at main · ChadenBA/TuniTour · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
input {
  file {
    path => "/var/log/nginx/access.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}

filter {
  grok {
    match => {
      "message" => [
        "%{IPORHOST:clientip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:httpmethod} %{URIPATHPARAM:requesturi} HTTP/%{NUMBER:httpversion}\" %{NUMBER:statuscode} %{NUMBER:bytes} \"%{GREEDYDATA:useragent}\""
      ]
    }
    add_tag => ["nginx-access"]
  }

  if "nginx-access" in [tags] {
    grok {
      match => {
        "requesturi" => [
          "^/login/?$" => "action:login",
          "^/logout/?$" => "action:logout",
          "^/profile/?$" => "action:view_profile",
          "^/profile/update/?$" => "action:update_profile",
          "^/search/?$" => "action:search",
        ]
      }
    }
  }

  date {
    match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
    target => "@timestamp"
  }
  useragent {
    source => "useragent"
    target => "user_agent"
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "tuni-%{+YYYY.MM.dd}"
  }
}