F5-HTTP-requesting-logging logstash filter

2017年11月9日 10989点热度 2人点赞 0条评论

input {
tcp {
port => 514
type => 'f5-request'
}
}



filter {
if [type] == "f5-request" {
grok {
match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}
}
geoip {
source => "clientip"
}
}
}

output {
elasticsearch {
hosts => ["192.168.214.130:9200"]
index => "f5-request-%{+YYYY.MM.dd}"
}
}

input {

tcp {

port => 514

type => 'f5-request'

}

filter {

if [type] == "f5-request" {

grok {

match => { "message" => "%{IP:clientip} \[%{HTTPDATE:timestamp}\] %{IP:virtual_ip} %{DATA:virtual_name} %{DATA:virtual_pool_name} %{DATA:server} %{NUMBER:server_port} \"%{DATA:path}\" \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response:int} %{NUMBER:bytes:int} %{NUMBER:response_ms:int} %{QS:referrer} %{QS:agent}"}

}

geoip {

source => "clientip"

}

output {

elasticsearch {

hosts => ["192.168.214.130:9200"]

index => "f5-request-%{+YYYY.MM.dd}"

}

保存上述配置为/etc/logstash/conf.d/f5-request-logging.conf

HTTP REQUESTING LOGGING TEMPLATE for response:

$CLIENT_IP $DATE_NCSA $VIRTUAL_IP $VIRTUAL_NAME $VIRTUAL_POOL_NAME $SERVER_IP $SERVER_PORT "$HTTP_PATH" "$HTTP_REQUEST" $HTTP_STATCODE $RESPONSE_SIZE $RESPONSE_MSECS "$Referer" "${User-agent}"

1	$CLIENT_IP $DATE_NCSA $VIRTUAL_IP $VIRTUAL_NAME $VIRTUAL_POOL_NAME $SERVER_IP $SERVER_PORT "$HTTP_PATH" "$HTTP_REQUEST" $HTTP_STATCODE $RESPONSE_SIZE $RESPONSE_MSECS "$Referer" "${User-agent}"