Initial commit: add .gitignore and README
This commit is contained in:
21
logstash/pipeline/20_quorum.conf
Normal file
21
logstash/pipeline/20_quorum.conf
Normal file
@@ -0,0 +1,21 @@
|
||||
filter {
|
||||
if [service_name] == "quorum" {
|
||||
grok {
|
||||
match => { "message" => "%{GREEDYDATA:level}\[%{MONTHNUM:monthnum}\-%{DATA:monthday}\|%{TIME:time}\] %{GREEDYDATA:message}" }
|
||||
overwrite => [ "message" ]
|
||||
}
|
||||
mutate {
|
||||
add_field => {
|
||||
"timestamp" => "%{monthnum} %{monthday} %{time}"
|
||||
}
|
||||
}
|
||||
date {
|
||||
match => [ "timestamp" , "MM dd HH:mm:ss.SSS", "MM dd HH:mm:ss.SSS", "ISO8601"]
|
||||
remove_field => [ "timestamp" ]
|
||||
}
|
||||
mutate {
|
||||
remove_field => [ "time" ,"month","monthday","year","timestamp"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user