F5-HTTP-requesting-logging logstash filter

input {
tcp {
port => 514
type => 'f5-request'
}
}



filter {
if [type] == "f5-request" {
grok {
match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}
}
geoip {
source => "clientip"
}
}
}

output {
elasticsearch {
hosts => ["192.168.214.130:9200"]
index => "f5-request-%{+YYYY.MM.dd}"
}
}

保存上述配置为/etc/logstash/conf.d/f5-request-logging.conf

HTTP REQUESTING LOGGING TEMPLATE for response:

$CLIENT_IP $DATE_NCSA $VIRTUAL_IP $VIRTUAL_NAME $VIRTUAL_POOL_NAME $SERVER_IP $SERVER_PORT "$HTTP_PATH" "$HTTP_REQUEST" $HTTP_STATCODE $RESPONSE_SIZE $RESPONSE_MSECS "$Referer" "${User-agent}"

启动logstash

./logstash -f /etc/logstash/conf.d/f5-request-logging.conf