36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
patterns:
|
|
common:
|
|
extractors:
|
|
- name: "syslog_header"
|
|
regex: '^(\w{3} \d{2} \d{2}:\d{2}:\d{2}) (?P<hostname>[^\s]+) (?P<process_info>[^:]+):\s*(?P<message_rest>.*)$'
|
|
fields:
|
|
syslog_timestamp: "time:Jan 02 15:04:05"
|
|
hostname: "string"
|
|
process_info: "string"
|
|
message_rest: "string"
|
|
|
|
- name: "iso8601_timestamp"
|
|
regex: '(?P<timestamp>\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?)'
|
|
fields:
|
|
timestamp: "time:2006-01-02T15:04:05.000000Z"
|
|
|
|
nginx:
|
|
extractors:
|
|
- name: "access_log"
|
|
regex: '^(?P<client_ip>\S+)\s+\S+\s+(?P<remote_user>\S+)\s+\[(?P<timestamp_nginx>[^\]]+)\]\s+"(?P<request>[^"]+)"\s+(?P<status_code>\d+)\s+(?P<bytes_sent>\d+|-)'
|
|
fields:
|
|
client_ip: "string"
|
|
remote_user: "string"
|
|
timestamp_nginx: "string"
|
|
request: "string"
|
|
status_code: "int"
|
|
bytes_sent: "int"
|
|
|
|
my-app:
|
|
extractors:
|
|
- name: "app_log"
|
|
regex: '^\[(?P<level>\w+)\] id=(?P<request_id>\d+) duration=(?P<duration_ms>\d+)ms'
|
|
fields:
|
|
level: "string"
|
|
request_id: "int"
|
|
duration_ms: "int"
|