| # |
| # Copyright 2014 The Charles Stark Draper Laboratory |
| # |
| # Licensed under the Apache License, Version 2.0 (the "License"); |
| # you may not use this file except in compliance with the License. |
| # You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| # |
| |
| input { |
| file { |
| codec => "json" |
| path => [ |
| "/var/log/xdata/xdata-old.log", |
| "/var/log/xdata/xdata-v2.log", |
| "/var/log/xdata/xdata-v3.log" |
| ] |
| start_position => beginning |
| } |
| } |
| |
| filter { |
| grok { |
| match => [ "apiVersion", "(?<major_ver>\d+).(?<minor_ver>\d+)(.(?<patch_ver>\d+))?" ] |
| } |
| |
| grok { |
| match => [ "useraleVersion", "(?<major_ver>\d+).(?<minor_ver>\d+)(.(?<patch_ver>\d+))?" ] |
| } |
| |
| mutate { |
| convert => { "major_ver" => "integer" } |
| convert => { "minor_ver" => "integer" } |
| convert => { "patch_ver" => "integer" } |
| } |
| } |
| |
| output { |
| if [oid] { |
| elasticsearch { |
| index => xdata_old |
| host => localhost |
| index_type => testing |
| } |
| } else if [major_ver] > 2 { |
| elasticsearch { |
| index => xdata_v3 |
| host => localhost |
| index_type => testing |
| } |
| } else { |
| elasticsearch { |
| index => xdata_v2 |
| host => localhost |
| index_type => testing |
| } |
| } |
| stdout { codec => rubydebug } |
| } |
| |