Forked from gerardorochin/php_error_logstash.conf
Created
September 30, 2019 09:01
-
-
Save xticriss/04f9e61a956859ac77f84918ac55b91f to your computer and use it in GitHub Desktop.
php error logging into logstash + elasticsearch and trace errors on single line and root path hidden
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| input { | |
| file { | |
| type => "php-error" | |
| path => "/var/www/error_log" | |
| sincedb_path => "/opt/logstash/sincedb-access" | |
| } | |
| } | |
| filter { | |
| mutate { | |
| gsub => [ | |
| "message", "/var/www", "", | |
| "message", "/var/www", "", | |
| "path", "/var/www", "" | |
| ] | |
| } | |
| if [type] == "php-error" { | |
| grok { | |
| match => [ "message", "\[%{MONTHDAY:day}-%{MONTH:month}-%{YEAR:year} %{TIME:time} %{WORD:zone}/%{WORD:country}\] PHP %{DATA:level}\: %{GREEDYDATA:error}" ] | |
| add_field => { "timestamp" => "%{day}-%{month}-%{year} %{time} %{zone}/%{country}" } | |
| add_tag => [ "%{level}" ] | |
| remove_field => [ "day", "month", "year", "time", "zone", "country" ] | |
| } | |
| multiline { | |
| pattern => "(Stack trace:)|(^#.+)|(^\"\")|( thrown+)|(^\s)" | |
| what => "previous" | |
| } | |
| date { | |
| timezone => "America/Mexico_City" | |
| match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss", "dd-MMM-yyyy HH:mm:ss ZZZ" ] | |
| target => "@timestamp" | |
| remove_field => "timestamp" | |
| } | |
| } | |
| mutate { | |
| uppercase => [ "level" ] | |
| lowercase => [ "tags" ] | |
| gsub => [ | |
| "tags", " ", "_", | |
| "level", " ", "_" | |
| ] | |
| } | |
| } | |
| output { | |
| stdout { | |
| codec => rubydebug | |
| } | |
| elasticsearch { | |
| host => "localhost" | |
| } | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment