Hi Eugene,
Progress so far ...
I'm using filebeat with different prospectors for each file type:
filebeat.prospectors:
- input_type: log
paths:
- c:\logs\confserv\*
scan_frequency: 10
close_inactive: 1m
document_type: genesys_confserv
tags: ["genesys"]
- input_type: log
paths:
- c:\logs\GIM\*
scan_frequency: 10
close_inactive: 1m
document_type: genesys_gim
tags: ["genesys"]
..... and so on
Then in logstash I have a beats input with a multline fliter to stitch multiple lines into a single event:
codec => multiline {
pattern => "%{TIME}(.*)"
negate => true
what => previous
}
The in the filter section I grok out interesting stuff link this ...
# Pull out useful metadata :-)
# Common
grok {
break_on_match => false
# 0001028debf65001
match => { "message" => "(.*?)(?<connid>[0-9a-f]{16})(.*)" }
# PU35RRP9HL2A59TA1L2JK5C938000001
match => { "message" => "(.*?)(?<calluuid>[0-9A-Z]{32})(.*)" }
# Attributes
match => { "message" => "(.*?)(AttributeCallState\t)%{NUMBER:callstate}(.*)" }
match => { "message" => "(.*?)(AttributeCallType\t)%{NUMBER:calltype}(.*)" }
match => { "message" => "(.*?)(AttributeCallID\t)(?<callid>[0-9+]+)(.*)" }
match => { "message" => "(.*?)(AttributeConnID\t)(?<connid>[0-9a-f]{16})(.*)" }
match => { "message" => "(.*?)(AttributeCallUUID\t)'(?<calluuid>[0-9A-Z]{32})(.*)" }
match => { "message" => "(.*?)(AttributeDNIS\t)(?<dnis>'[0-9+]+')(.*)" }
match => { "message" => "(.*?)(AttributeANI\t)(?<ani>'[0-9+]+')(.*)" }
match => { "message" => "(.*?)(AttributeThisDN\t)(?<thisdn>'[0-9+]+')(.*)" }
match => { "message" => "(.*?)(AttributeThisQueue\t)(?<thisqueue>'[0-9+]+')(.*)" }
match => { "message" => "(.*?)(AttributePartyUUID\t)'(?<calluuid>[0-9A-Z]{32})(.*)" }
match => { "message" => "(.*?)(AttributeOtherDN\t)(?<otherdn>'[0-9+]+')(.*)" }
# Events
match => { "message" => "(.*?)(?<eventName>Event[A-Z]\w+)(.*)" }
}
# Genesys Configuration Server
if ([type] == "genesys_confserv") {
grok {
break_on_match => false
# 12:08:38.187 Std 04523 Connection to client '376' closed, reason 'Server with this name is already running'
match => { "message" => "%{TIME:timestamp} %{WORD:logLevel} %{NUMBER:logMsgId}( .*)" }
# Object: [CfgFolder], name [Demands], DBID: [268] is deleted by client, type [SCE], name: [default], user: [default]
match => { "message" => "(.*?)(Object: )(?<objecttype>\[(.*?)\])(,.*)(name )(?<objectname>\[(.*?)\])(,.*)(is )(?<action>(.*?))( .*)(user: )(?<username>\[(.*?)\])" }
}
}
