ELK学习笔记之F5-HTTP-requesting-logging logstash filter

 

input {
tcp {
port => 514
type => 'f5-request'
}
}



filter {
if [type] == "f5-request" {
grok {
match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}
}
geoip {
source => "clientip"
}
}
}

output {
elasticsearch {
hosts => ["192.168.214.130:9200"]
index => "f5-request-%{+YYYY.MM.dd}"
}
}