rich1.0phorkiehttps://p.cweiske.de/logstash + apacheChristian Weiske86400900900<!-- embedding all files of https://p.cweiske.de/56 -->
<link rel="stylesheet" href="https://p.cweiske.de/css/embed.css"/>
<div class="phork" id="56">
<div class="phork-file">
<div class="phork-content">
<div class="document">
<p>Working logstash 1.2.1 configuration for apache 2.2 and <tt class="docutils literal">/var/log/apache2/other_vhosts_access.log</tt> files.</p>
<p>Run with:</p>
<pre class="literal-block">
$ java -jar logstash-1.2.1-flatjar.jar agent -f apache.conf -- web
</pre>
</div>
</div>
<div class="phork-meta">
<a href="https://p.cweiske.de/56/rev-raw/733ab80fed1cdbec2d16a1dca4eae00a9bcc055b/README.rst" style="float: right">view raw source</a>
<a href="https://p.cweiske.de/56#README.rst">README.rst</a>
</div>
</div>
<div class="phork-file">
<div class="phork-content">
<style type="text/css">/**
* GeSHi (C) 2004 - 2007 Nigel McNie, 2007 - 2008 Benny Baumann
* (http://qbnz.com/highlighter/ and http://geshi.org/)
*/
.ini .de1, .ini .de2 {font: normal normal 1em/1.2em monospace; margin:0; padding:0; background:none; vertical-align:top;}
.ini {font-family:monospace;}
.ini .imp {font-weight: bold; color: red;}
.ini li, .ini .li1 {color: #DDD;}
.ini .ln {width:1px;text-align:right;margin:0;padding:0 2px;vertical-align:top;}
.ini .co0 {color: #666666; font-style: italic;}
.ini .sy0 {color: #000066; font-weight:bold;}
.ini .st0 {color: #933;}
.ini .re0 {color: #000066; font-weight:bold;}
.ini .re1 {color: #000099;}
.ini .re2 {color: #660066;}
.ini span.xtra { display:block; }
</style><div class="code"><table class="ini"><tbody><tr class="li1"><td class="ln"><pre class="de1">1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
</pre></td><td class="de1"><pre class="de1">input <span class="br0">{</span>
  file <span class="br0">{</span>
    <span class="re1">path</span> <span class="sy0">=</span><span class="re2">> </span><span class="st0">"/var/log/apache2/*access.log"</span>
    <span class="re1">type</span> <span class="sy0">=</span><span class="re2">> </span><span class="st0">"apache-access"</span>
  <span class="br0">}</span>
<span class="br0">}</span>
 
filter <span class="br0">{</span>
  if <span class="re0"><span class="br0">[</span>type<span class="br0">]</span></span> <span class="sy0">=</span><span class="re2">= </span><span class="st0">"apache-access"</span> <span class="br0">{</span>
    grok <span class="br0">{</span>
      <span class="re1">match</span> <span class="sy0">=</span><span class="re2">> <span class="br0">[</span> </span><span class="st0">"message"</span>, <span class="st0">"%{URIHOST:fullhost} %{COMBINEDAPACHELOG}"</span><span class="br0">]</span>
    <span class="br0">}</span>
  <span class="br0">}</span>
<span class="br0">}</span>
 
output <span class="br0">{</span>
  stdout <span class="br0">{</span>
    <span class="re1">codec</span> <span class="sy0">=</span><span class="re2">> rubydebug</span>
    #debug <span class="sy0">=</span><span class="re2">> true</span>
  <span class="br0">}</span>
  elasticsearch <span class="br0">{</span> embedded <span class="sy0">=</span><span class="re2">> true <span class="br0">}</span></span>
<span class="br0">}</span>
 </pre></td></tr></tbody></table></div>
</div>
<div class="phork-meta">
<a href="https://p.cweiske.de/56/rev-raw/733ab80fed1cdbec2d16a1dca4eae00a9bcc055b/apache.conf" style="float: right">view raw source</a>
<a href="https://p.cweiske.de/56#apache.conf">apache.conf</a>
</div>
</div>
</div>