41 lines
1,021 B
TOML
41 lines
1,021 B
TOML
# Vector pipeline that collects logs and sends them to ElasticSearch
|
|
[sources.redis_logs_from_file]
|
|
type = "file"
|
|
include = [
|
|
"/var/log/redis/redis-server.log",
|
|
]
|
|
|
|
# Parse data
|
|
[transforms.parse_redis_logs]
|
|
type = "remap"
|
|
inputs = [
|
|
"redis_logs_from_file"
|
|
]
|
|
source = '''
|
|
source_file = .file
|
|
|
|
parsed, err = parse_regex(.message, r'[^ ](?P<timestamp>\s\d{2} \S* \d{4} \d{2}:\d{2}:\d{2}.\d*) (?P<message>.*)')
|
|
message = replace(.message, parsed.timestamp, "") ?? ""
|
|
|
|
if err != null {
|
|
abort
|
|
}
|
|
|
|
. = {}
|
|
.timestamp = now()
|
|
.message = message
|
|
.file = source_file
|
|
'''
|
|
|
|
|
|
[sinks.redis_logs_to_es]
|
|
type = "elasticsearch"
|
|
inputs = ["parse_redis_logs"]
|
|
compression = "none"
|
|
healthcheck = true
|
|
auth.strategy= "basic"
|
|
auth.user = "{{ elastic_login }}"
|
|
auth.password = "{{ elastic_password }}"
|
|
endpoint = "{{ elastic_url }}"
|
|
normal.index = "system-logs"
|
|
id_key = "event_uuid"
|