Setup logstash

logstash/10-input.conf

@@ -0,0 +1,31 @@
+input {
+  file {
+    path => "/var/log/temperature.log"
+    start_position => "beginning"
+    sincedb_path => "/dev/null"
+    add_field => {
+        "type" => "temperature"
+        "host.hostname" => "praguetopbox"
+    }
+  }
+
+  file {
+    path => "/var/log/power_usage.log"
+    start_position => "beginning"
+    sincedb_path => "/dev/null"
+    add_field => {
+        "type" => "power"
+        "host.hostname" => "praguetopbox"
+    }
+  }
+
+  file {
+    path => "/var/log/disk_usage.log"
+    start_position => "beginning"
+    sincedb_path => "/dev/null"
+    add_field => {
+        "type" => "disk"
+        "host.hostname" => "praguetopbox"
+    }
+  }
+}

logstash/20-temperature.conf

@@ -0,0 +1,18 @@
+filter {
+  if [type] == "temperature" {
+    dissect {
+      mapping => {
+        "message" => "%{timestamp} %{system.temperature.sensor_name} %{system.temperature.value}°C"
+      }
+    }
+
+    date {
+      match => ["timestamp", "ISO8601"]
+      target => "@timestamp"
+    }
+
+    mutate {
+      convert => { "system.temperature.value" => "float" }
+    }
+  }
+}

logstash/21-power-usage.conf

@@ -0,0 +1,18 @@
+filter {
+  if [type] == "power" {
+    dissect {
+      mapping => {
+        "message" => "%{timestamp} %{system.power.value}"
+      }
+    }
+
+    date {
+      match => ["timestamp", "ISO8601"]
+      target => "@timestamp"
+    }
+
+    mutate {
+      convert => { "system.power.value" => "float" }
+    }
+  }
+}

logstash/22-disk-usage.conf

@@ -0,0 +1,66 @@
+filter {
+  if [type] == "disk" {
+    dissect {
+      mapping => {
+        "message" => "%{timestamp} %{system.disk.mount_point} %{system.disk.used} %{system.disk.total}"
+      }
+    }
+
+    date {
+      match => ["timestamp", "ISO8601"]
+      target => "@timestamp"
+    }
+
+    mutate {
+      convert => { 
+        "system.disk.used" => "integer"
+        "system.disk.total" => "integer"
+      }
+    }
+
+    ruby {
+      code => "
+        used = event.get('system.disk.used').to_f
+        total = event.get('system.disk.total').to_f
+        if total > 0
+          percentage = (used / total) * 100
+          event.set('system.disk.usage_percent', percentage.round(2))
+        end
+      "
+    }
+
+    ruby {
+      code => "
+        def bytes_to_human(bytes)
+          units = ['B', 'KB', 'MB', 'GB', 'TB']
+          return '0 B' if bytes == 0
+          
+          exp = (Math.log(bytes) / Math.log(1024)).floor
+          exp = [exp, units.length - 1].min
+          
+          size = bytes / (1024.0 ** exp)
+          unit = units[exp]
+          
+          if size >= 100
+            '%.0f %s' % [size, unit]
+          elsif size >= 10
+            '%.1f %s' % [size, unit]
+          else
+            '%.2f %s' % [size, unit]
+          end
+        end
+
+        used_bytes = event.get('system.disk.used')
+        total_bytes = event.get('system.disk.total')
+        
+        if used_bytes
+          event.set('system.disk.used_human', bytes_to_human(used_bytes))
+        end
+        
+        if total_bytes
+          event.set('system.disk.total_human', bytes_to_human(total_bytes))
+        end
+      "
+    }
+  }
+}

logstash/90-output.conf

@@ -0,0 +1,12 @@
+output {
+  # Forward logs to Elasticsearch
+  elasticsearch {
+    hosts => ["http://localhost:9200"]
+    index => "replace-index"  # Index pattern based on log type and date
+    user => "replace-user"
+    password => "replace-password"
+  }
+  if "_grokparsefailure" in [tags] {
+    stdout { codec => rubydebug }
+  }
+}