Logstashの設定をするときのメモ

input {
  stdin {}
}

filter {
  grok {
    patterns_dir => ["/etc/logstash/pattern.d"]
    match => { "message" => "なにか" }
  }
}

output {
  stdout {}
}

filter {
  if "OK" in [message] {
    grok {
      patterns_dir => [ "/etc/logstash/patterns.d/mypattern" ]
      match => { "message" => "%{MYLOG}"}
    }
    date {
      match => [ "start","UNIX" ]
      target => "@timestamp"
    }
    date {
      match => [ "start","UNIX" ]
      target => "start_time"
    }
    geoip {
      source => "ipaddr"
      target => "ipaddr_geoip"
      tag_on_failure => "eoip_lookup_failure"
    }
  }
}