41 lines
1,014 B
TOML
41 lines
1,014 B
TOML
# Vector pipeline that collects logs and sends them to ElasticSearch
|
|
[sources.console_logs_from_file]
|
|
type = "file"
|
|
include = [
|
|
"/var/log/armaconsole/console.log",
|
|
]
|
|
|
|
# Parse data
|
|
[transforms.parse_console_logs]
|
|
type = "remap"
|
|
inputs = [
|
|
"console_logs_from_file"
|
|
]
|
|
source = '''
|
|
source_file = .file
|
|
|
|
parsed, err = parse_regex(.message, r'(?P<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d*) (?P<level>[^ ]*) (?P<message>.*)')
|
|
message = parsed.message
|
|
|
|
if err != null {
|
|
abort
|
|
}
|
|
|
|
. = {}
|
|
.timestamp = now()
|
|
.message = message
|
|
.file = source_file
|
|
'''
|
|
|
|
|
|
[sinks.console_logs_to_es]
|
|
type = "elasticsearch"
|
|
inputs = ["parse_console_logs"]
|
|
compression = "none"
|
|
healthcheck = true
|
|
auth.strategy= "basic"
|
|
auth.user = "{{ elastic_login }}"
|
|
auth.password = "{{ elastic_password }}"
|
|
endpoint = "{{ elastic_url }}"
|
|
normal.index = "system-logs"
|
|
id_key = "event_uuid"
|