82 lines
2.5 KiB
JSON
82 lines
2.5 KiB
JSON
curl -H "Content-Type: application/json" -X PUT http://127.0.0.1:9200/_ingest/pipeline/nginx-access -d '
|
|
{
|
|
"description" : "nginx-access",
|
|
"processors" : [
|
|
{
|
|
"grok" : {
|
|
"field" : "message",
|
|
"patterns" : [
|
|
"^%{DATA:nginx.access.remote_ip} - \\[%{HTTPDATE:nginx.access.time}\\] \"%{WORD:nginx.access.method} %{DATA:nginx.access.url}\" \"%{DATA:nginx.access.args}\" \"%{DATA:nginx.access.request_body}\" %{NUMBER:nginx.access.response_code} %{NUMBER:nginx.access.body_sent.bytes} \"%{DATA:nginx.access.referrer}\" \"%{DATA:nginx.access.agent}\" \"%{DATA:nginx.access.x_forward_for}\""
|
|
],
|
|
"ignore_missing" : true,
|
|
"ignore_failure" : true
|
|
}
|
|
},
|
|
{
|
|
"geoip" : {
|
|
"field" : "nginx.access.remote_ip",
|
|
"target_field" : "nginx.access.geoip",
|
|
"ignore_missing" : true,
|
|
"ignore_failure" : true
|
|
}
|
|
},
|
|
{
|
|
"rename" : {
|
|
"field" : "@timestamp",
|
|
"target_field" : "read_timestamp"
|
|
}
|
|
},
|
|
{
|
|
"date" : {
|
|
"formats" : [
|
|
"dd/MMM/YYYY:H:m:s Z"
|
|
],
|
|
"timezone" : "Asia/Shanghai",
|
|
"field" : "nginx.access.time",
|
|
"target_field" : "@timestamp",
|
|
"ignore_failure" : true
|
|
}
|
|
},
|
|
{
|
|
"grok" : {
|
|
"field" : "nginx.access.agent",
|
|
"patterns" : [
|
|
"%{ANDROID:nginx.access.os}",
|
|
"%{LINUX:nginx.access.os}",
|
|
"%{IOS:nginx.access.os}",
|
|
"%{MACOSX:nginx.access.os}",
|
|
"%{WINDOWS:nginx.access.os}",
|
|
"%{DARWIN:nginx.access.os}",
|
|
"%{SOGOU:nginx.access.os}",
|
|
"%{BINGBOT:nginx.access.os}",
|
|
"%{OFFICE:nginx.access.os}"
|
|
],
|
|
"pattern_definitions" : {
|
|
"ANDROID" : "Android *[0-9]*",
|
|
"LINUX" : "Linux (x86_64|i386|i686)",
|
|
"IOS" : "OS [0-9]+",
|
|
"MACOSX" : "Mac OS X [0-9]+",
|
|
"WINDOWS" : "Windows NT [0-9.]+",
|
|
"DARWIN" : "Darwin",
|
|
"SOGOU" : "Sogou web spider",
|
|
"BINGBOT" : "bingbot",
|
|
"OFFICE" : "Microsoft Office [^ ]*"
|
|
},
|
|
"ignore_missing" : true,
|
|
"ignore_failure" : true
|
|
}
|
|
},
|
|
{
|
|
"remove" : {
|
|
"field" : "nginx.access.time",
|
|
"ignore_failure" : true
|
|
}
|
|
},
|
|
{
|
|
"remove" : {
|
|
"field" : "message"
|
|
}
|
|
}
|
|
]
|
|
}'
|