amacocian/ServerManagementUtils
1
0
Fork 0
mirror of https://github.com/AlexMacocian/ServerManagementUtils.git synced 2026-07-15 15:19:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use RFC5424 logging handler

Browse Source
This commit is contained in:
Alexandru Victor Macocian
2025-08-01 11:25:08 +02:00
parent 7711af4c6a
commit bcca33c2b5
1 changed files with 35 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
logstash/conf.d/30-syslog.conf
+35 -5
View File
@@ -12,12 +12,42 @@ input {
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
match => {
"message" => "<%{NONNEGINT:syslog_pri}>%{NONNEGINT:version}%{SPACE}(?:-|%{TIMESTAMP_ISO8601:syslog_timestamp})%{SPACE}(?:-|%{IPORHOST:hostname})%{SPACE}(?:%{SYSLOG5424PRINTASCII:program}|-)%{SPACE}(?:-|%{SYSLOG5424PRINTASCII:process_id})%{SPACE}(?:-|%{SYSLOG5424PRINTASCII:message_id})%{SPACE}(?:-|(?<structured_data>(\[.*?[^\\]\])+))(?:%{SPACE}%{GREEDYDATA:syslog_message}|)"
}
add_tag => [ "match" ]
}
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
if "match" in [tags] {
syslog_pri {
remove_field => "syslog_pri"
}
date {
match => [ "syslog_timestamp", "ISO8601", "MMM dd HH:mm:ss", "MMM dd HH:mm:ss.SSS" ]
remove_field => "syslog_timestamp"
}
if [structured_data] {
ruby {
code => '
# https://github.com/logstash-plugins/logstash-input-syslog/issues/15#issuecomment-270367033
def extract_syslog5424_sd(syslog5424_sd)
sd = {}
syslog5424_sd.scan(/\[(?<element>.*?[^\\])\]/) do |element|
data = element[0].match(/(?<sd_id>[^\ ]+)(?<sd_params> .*)?/)
sd_id = data[:sd_id].split("@", 2)[0]
sd[sd_id] = {}
next if data.nil? || data[:sd_params].nil?
data[:sd_params].scan(/ (.*?[=](?:""|".*?[^\\]"))/) do |set|
set = set[0].match(/(?<param_name>.*?)[=]\"(?<param_value>.*)\"/)
sd[sd_id][set[:param_name]] = set[:param_value]
end
end
sd
end
event.set("[sd]", extract_syslog5424_sd(event.get("[structured_data]")))
'
remove_field => "structured_data"
}
}
}
}
}