# apt-get install ruby rubygems rpm dpkg-dev # gem install fpm
$ mkdir logstash && cd logstash && touch build.sh && chmod +x build.sh && vim build.sh
#!/bin/bash JAR_URL="https://download.elasticsearch.org/logstash/logstash/logstash-1.2.2-flatjar.jar" JAR_FILE="usr/share/logstash/logstash.jar" DESCRIPTION="Logstash Open Source Log Management" EMAIL="admin@logstash.net" URL='http://www.logstash.net/' VERSION="1.2.2" NAME="logstash" # if [ ! -d "usr" ]; then mkdir -p {etc,usr/share/logstash,var/logstash} fi # logstash if [ ! -f "$JAR_FILE" ]; then wget "$JAR_URL" -O "$JAR_FILE" fi cd .. function build() { fpm -n $NAME -v $VERSION -a all -C logstash -m "<$EMAIL>" \ --pre-install logstash/preinstall \ --description "$DESCRIPTION" \ --url "$URL" -t "$1" -d "$2" \ --config-files etc/logstash/syslog.conf \ -s dir etc usr var } # build "deb" "default-jre" build "rpm" "java-1.6.0-openjdk-devel"
$ mkdir -p etc/logstash && vim etc/logstash/syslog.conf
input { file { type => "syslog_file" exclude => [ "logstash.log*" ] path => [ "/var/log/messages", "/var/log/syslog", "/var/log/*.log" ] } } filter { grok { type => "syslog_relay" pattern => [ "^<[1-9]\d{0,2}>%{SPACE}%{GREEDYDATA:message_remainder}" ] add_tag => "got_syslog_pri" add_field => [ "syslog_raw_message", "%{@message}" ] } syslog_pri { type => "syslog_relay" tags => [ "got_syslog_pri" ] } mutate { type => "syslog_relay" tags => [ "got_syslog_pri" ] replace => [ "@message", "%{message_remainder}" ] remove => [ "message_remainder" ] remove_tag => "got_syslog_pri" } grok { type => "syslog_relay" pattern => [ "^%{SYSLOGTIMESTAMP:syslog_timestamp}%{SPACE}%{GREEDYDATA:message_remainder}" ] add_tag => "got_syslog_timestamp" add_field => [ "received_at", "%{@timestamp}" ] } date { type => "syslog_relay" tags => [ "got_syslog_timestamp" ] # season to taste for your own syslog format(s) match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601" ] } mutate { type => "syslog_relay" tags => [ "got_syslog_timestamp" ] replace => [ "@message", "%{message_remainder}" ] remove => [ "message_remainder" ] remove_tag => "got_syslog_timestamp" } grok { type => "syslog_relay" pattern => [ "^%{SYSLOGHOST:syslog_hostname}%{SPACE}%{GREEDYDATA:message_remainder}" ] add_tag => "got_syslog_host" add_field => [ "logstash_source", "%{@source_host}" ] } mutate { type => "syslog_relay" tags => [ "got_syslog_host" ] replace => [ "@source_host", "%{syslog_hostname}" ] replace => [ "@message", "%{message_remainder}" ] remove => [ "message_remainder" ] remove_tag => "got_syslog_host" } grok { type => "syslog_relay" pattern => [ "^%{SYSLOGPROG:syslog_prog}:%{SPACE}%{GREEDYDATA:message_remainder}" ] add_tag => "got_syslog_prog" } mutate { type => "syslog_relay" tags => [ "got_syslog_prog" ] replace => [ "@message", "%{message_remainder}" ] remove => [ "message_remainder" ] remove_tag => "got_syslog_prog" } dns { type => 'syslog_relay' reverse => [ "@source_host", "@source_host" ] action => "replace" } mutate { type => "syslog_relay" tags => [ "syslog" ] remove => [ "syslog_hostname", "syslog_timestamp" ] } }
$ cat > preinstall << END #!/bin/bash useradd -g adm -r -m -d /usr/share/logstash -s /bin/false logstash || exit 0 END
# ./build.sh
# dpkg -i ../logstash*.deb && apt-get install -f # java -jar /usr/share/logstash/logstash.jar agent -f /etc/logstash --log /var/log/logstash.log
Source: https://habr.com/ru/post/200774/
All Articles