add_field => { "read_timestamp" => "%{@timestamp}" }
}
date {
match => [ "[nginx][access][time]", "dd/MMM/YYYY:H:m:s Z" ]
remove_field => "[nginx][access][time]"
}
useragent {
source => "[nginx][access][agent]"
target => "[nginx][access][user_agent]"
remove_field => "[nginx][access][agent]"
}
geoip {
source => "[nginx][access][remote_ip]"
target => "[nginx][access][geoip]"
}
}
else if [fileset][name] == "error" {
grok {
match => { "message" => ["%{DATA:[nginx][error][time]}
\[%{DATA:[nginx][error][level]}\]
%{NUMBER:[nginx][error][pid]}#%{NUMBER:[nginx][error][tid]}:
(\*%{NUMBER:[nginx][error][connection_id]} )?%{GREEDYDATA:[nginx][error][message]}"] }
remove_field => "message"
}
mutate {
rename => { "@timestamp" => "read_timestamp" }
}
date {
match => [ "[nginx][error][time]", "YYYY/MM/dd H:m:s" ]
remove_field => "[nginx][error][time]"
}
}
}
}
Фильтрация и обработка логов для отправки в OpsGenie
filter {
mutate{
add_field => {
"alias" => "%{[cloudwatch_logs][event_id]}"
"opsgenieAction" => "create"
"description" => "%{stack_trace}"
"tags" => ["{{ logstash.profile }}", "%{[cloudwatch_logs][ingestion_time]}",
"%{[cloudwatch_logs][event_id]}"]
"[details][organizationId]"=> "%{organizationId}"
"[details][channelId]" => "%{channelId}"
"[details][messageId]" => "%{messageId}"
"[details][flowId]" => "%{flowId}"
"[details][externalPropertyId]" => "%{externalPropertyId}"
"[details][repositoryId]" => "%{repositoryId}"
"[details][propertyCode]" => "%{propertyCode}"
"[details][chainCode]" => "%{chainCode}"
"[details][outboundChannelId]" => "%{outboundChannelId}"