vendredi 7 août 2015

Logstash + Amazon Clouwatch

I'm trying to push apache access logs to Amazon Cloud Watch using logstash

This is my config

    input {
      file {
        type => "syslog"
        add_field => [ "CW_metric", "syslog" ]
        path => "/var/log/syslog"
        start_position => "beginning"
      }
    }

filter {
      if [type] == "syslog" {
        grok {
          match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
          add_field => [ "received_at", "%{@timestamp}" ]
          add_field => [ "received_from", "%{host}" ]
        }
        syslog_pri { }
        date {
          match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
        }
      }
    }   

    output
        {
        cloudwatch 
            {
            access_key_id => 'xxxxxxxxxxxxxxxxxxxxxx'
            secret_access_key => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'
            region => 'us-east-1'

        }
    }

But, it doesn't seem to work. Am I missing something, or the entire approach is wrong. Please suggest me a sample config for syslog




Aucun commentaire:

Enregistrer un commentaire