# From The Logstash Book
# The original of this file can be found at: http://logstashbook.com/code/index.html
#
input {
  file {
    type => "syslog"
    path => ["/var/log/secure", "/var/log/messages"]
    exclude => ["*.gz"]
  }
  file {
    type => "apache"
    path => ["/var/log/httpd/logstash_access_log"]
  }
  file {
    type => "tomcat"
    path => [ "/var/log/tomcat6/catalina.out" ]
    codec => multiline {
      pattern => "(^\d+\serror)|(^.+Exception: .+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
      what => "previous"
    }
  }
  file {
    type => "postfix"
    path => ["/var/log/mail.*"]
  }
  file {
    type => "alpha"
    path => ["/opt/alpha/logs/alpha.log"]
    tags => [ "alpha", "finance" ]
  }
  if [type] == "syslog" {
    grok {
      match => [ "message", "%{SYSLOGBASE} <notice> STONITH: %{IPORHOST:cluster_node} has been fenced!" ]
      add_tag => [ "nagios_check" ]
      add_field => [
        "nagios_host", "%{cluster_node}",
        "nagios_service", "cluster"
      ]
    }
  }
}
filter {
   if [type] == "apache" {
      date {
        match => [ "timestamp", "ISO8601" ]
        add_tag => [ "dated" ]
      }
   }
   if [type] == "syslog" {
     grok {
       match => [ "message", "%{SYSLOGBASE} Failed password for %{USERNAME:user} from %{IPORHOST:shost} port %{POSINT:port} %{WORD:protocol}" ]
       add_tag => [ "ssh", "grokked", "auth_failure" ]
     }
   }
   if [type] == "postfix" {
    grok {
      patterns_dir => ["/etc/logstash/patterns"]
      match => [ "message", "%{POSTFIX}" ]
      add_tag => [ "postfix", "grokked", "%{component}" ]
    }
    if "qmgr" in [tags] {
      grok {
        patterns_dir => ["/etc/logstash/patterns"]
        match => [ "message", "%{POSTFIXQMGR}" ]
      }
    }
    date {
      match => [ "timestamp", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss" ]
      add_tag => [ "dated" ]
    }
  }
  if [type] == "tomcat" and [message] !~ /(.+)/ {
    drop { }
  }
  if [type] == "tomcat" and "multiline" in [tags] {
    grok {
      match => [ "message", "%{JAVASTACKTRACEPART}" ]
    }
  }
  if [type] == "alpha" {
    grok {
      match => [ "message", "(?<timestamp>[\d]+)\+(?<tz>[\w]{4})\s(?<msg>.*)\s%{UNIXPATH:file}\#%{POSINT:line}\s%{GREEDYDATA:id}\s%{WORD:appname}\/(?<appver>[\d.\d.\d\w]+)\/(?<apprelease>[\w\s]+)" ]
      add_tag => [ "grokked" ]
    }
    date {
      match => [ "timestamp", "UNIX" ]
      timezone => tz
      add_tag => [ "dated" ]
    }
    if [apprelease] == "QA Release" {
      mutate {
        add_field => [ "environment", "qa" ]
      }
    }
    else {
      mutate {
        add_field => [ "environment", "production" ]
      }
    }
    mutate {
      convert => [ "line", "integer" ]
    }
  }
}
output {
  stdout { }
  redis { host => "10.0.0.1" data_type => "list" key => "logstash" }
}
