...
...
TODO: Details on using systemvm for elasticsearch nodes.
Logstash Configuration on the log shipping layer.
input {
file {
type => "apache"
path => \ [ "/var/log/cloudstack/management/management-server.log" \]
\}
}
output {
amqp \{
host => "myamqpserver"
exchange_type => "fanout"
name => "rawlogs"
\}
] Wiki Markup
}
}
output {
amqp {
host => "myamqpserver"
exchange_type => "fanout"
name => "rawlogs"
}
}
Logstash configuration on the index/search layer.
input {
amqp {
type => "all"
host => "<host>"
exchange => "rawlogs"
name => "<name>"
}
}unmigrated-wiki-markup
filter {
grok \{
type => "apache"
pattern => "%\{YEAR\}-%\{MONTHNUM\}-%\{MONTHDAY\}\[T \]%\{HOUR\{
grok {
type => "apache"
pattern => "%{YEAR}%{MONTHNUM}%{MONTHDAY}[T ]%{HOUR}\:?%\{MINUTE\}\:?%\{SECOND\}\[T \ ]INFO%\{GREEDYDATA\}job\[-\]+%\{INT\:jobid\}\s*=\s*\[\s*%\{UUID\:uuid\}\s\*
\\
\
]%\{GREEDYDATA\}"
\}
}
}
output {
elasticsearch {
host => "<elasticsearch_master>"
}
}
...