I'm trying to push apache access logs to Amazon Cloud Watch using logstash
This is my config
input {
file {
type => "syslog"
add_field => [ "CW_metric", "syslog" ]
path => "/var/log/syslog"
start_position => "beginning"
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output
{
cloudwatch
{
access_key_id => 'xxxxxxxxxxxxxxxxxxxxxx'
secret_access_key => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'
region => 'us-east-1'
}
}
But, it doesn't seem to work. Am I missing something, or the entire approach is wrong. Please suggest me a sample config for syslog
Aucun commentaire:
Enregistrer un commentaire