added logstash apache filter

SecurityRiskAdvisors · Jul 5, 2018 · 053a117 · 053a117
1 parent 701f74a
commit 053a117
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 5 deletions.
diff --git a/ansible/install/roles/logstash/templates/02-beats-input.conf.j2 b/ansible/install/roles/logstash/templates/02-beats-input.conf.j2
@@ -8,6 +8,12 @@ input {
   }
 }
 
+filter {
+    grok {
+        match => { "message" => "%{COMBINEDAPACHELOG}"}
+    }
+}
+
 output {
   elasticsearch {
     hosts => "localhost:{{es_local_port}}"

diff --git a/elastic/logstash/beats.conf b/elastic/logstash/beats.conf
@@ -4,11 +4,11 @@ input {
   }
 }
 
-# The filter part of this file is commented out to indicate that it is
-# optional.
-# filter {
-#
-# }
+filter {
+    grok {
+        match => { "message" => "%{COMBINEDAPACHELOG}"}
+    }
+}
 
 output {
   elasticsearch {