46 lines
1.3 KiB
TOML
46 lines
1.3 KiB
TOML
# Vector pipeline that collects logs and sends them to ElasticSearch
|
|
[sources.nginx_logs_from_file]
|
|
type = "file"
|
|
include = [
|
|
"/var/log/armaconsole/nginx.error.log",
|
|
"/var/log/armaconsole/nginx.access.log",
|
|
]
|
|
|
|
# Parse data
|
|
[transforms.parse_nginx_logs]
|
|
type = "remap"
|
|
inputs = [
|
|
"nginx_logs_from_file"
|
|
]
|
|
source = '''
|
|
source_file = .file
|
|
|
|
if ends_with(.file, "nginx.error.log") {
|
|
parsed, err = parse_regex(.message, r'(?P<timestamp>\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}) (?P<message>.*)')
|
|
message = parsed.message
|
|
} else if ends_with(.file, "nginx.access.log") {
|
|
parsed, err = parse_regex(.message, r'(?P<timestamp>\s\[\d{2}/\D+/\d{4}:\d{2}:\d{2}:\d{2} \+\d{4}\])')
|
|
message = replace(.message, parsed.timestamp, "") ?? ""
|
|
}
|
|
if err != null {
|
|
abort
|
|
}
|
|
|
|
. = {}
|
|
.timestamp = now()
|
|
.message = message
|
|
.file = source_file
|
|
'''
|
|
|
|
|
|
[sinks.nginx_logs_to_es]
|
|
type = "elasticsearch"
|
|
inputs = ["parse_nginx_logs"]
|
|
compression = "none"
|
|
healthcheck = true
|
|
auth.strategy= "basic"
|
|
auth.user = "{{ elastic_login }}"
|
|
auth.password = "{{ elastic_password }}"
|
|
endpoint = "{{ elastic_url }}"
|
|
normal.index = "system-logs"
|
|
id_key = "event_uuid"
|