syslog 분석 중

 

# datastream mapping 업데이트하기 , index patterns 를 꼭 써주세요.

 

PUT _index_template/logs-fortinet_fortigate.log

{

  "index_patterns": ["logs-fortinet_fortigate.log-*"],

  "template": {

    "mappings": {

      "properties": {

        "mytest":{

          "type": "keyword"

        }

      }

    }

  }

}

 

 

 

PUT _ingest/pipeline/syslog_pipeline

{

  "processors": [

    {

      "grok": {

        "field": "message",

        "patterns": ["<%{INT:syslog.pri}>%{WORD:timestamp}:%{NUMBER:some_id}:\"\\[%{WORD:source}\\]\":%{WORD:status}:%{NUMBER:t_id}:R:S:1:\"\\[%{WORD:source}\\]\":%{DATA:id}:%{DATA:id1}:%{DATA:id2}:A:26:\"\\[%{WORD:source1}\\]\":%{IP:ip_address}:%{NUMBER:some_flag}:\"\\[%{DATA:source2}\\]\":0000:"]

      }

    },

    {

      "date": {

        "field": "timestamp",

        "target_field": "parsed_timestamp",

        "formats": ["yyyyMMddHHmmss"],

        "timezone": "Asia/Seoul"

      }

    }

  ],

  "on_failure": [

    {

      "set": {

        "field": "pipeline_error",

        "value": "General failure in pipeline processing"

      }

    }

  ]

}