NAME
Search::ESsearcher::Templates::syslog - Provides syslog support for essearcher.
VERSION
Version 1.1.1
LOGSTASH
This uses a logstash configuration below.
input {
syslog {
host => "10.10.10.10"
port => 11514
type => "syslog"
}
}
filter { }
output {
if [type] == "syslog" {
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
}
}
}The important bit is "type" being set to "syslog". If that is not used, use the command line options field and fieldv.
Options
--host <log host>
The syslog server.
The search is done with .keyword appended to the field name.
--hostx <log host>
The syslog server.
Does not run the it through aonHost.
The search is done with .keyword appended to the field name.
--src <src server>
The source server sending to the syslog server.
The search is done with .keyword appended to the field name.
--srcx <src server>
The source server sending to the syslog server.
Does not run the it through aonHost.
The search is done with .keyword appended to the field name.
--program <program>
The name of the daemon/program in question.
--size <count>
The number of items to return.
--facility <facility>
The syslog facility.
--severity <severity>
The severity level of the message.
--pid <pid>
The PID that sent the message.--dgt <date>
Date greater than.
--dgte <date>
Date greater than or equal to.
--dlt <date>
Date less than.
--dlte <date>
Date less than or equal to.
--msg <message>
Messages to match.
--field <field>
The term field to use for matching them all.
--fieldv <fieldv>
The value of the term field to matching them all.
AND, OR, or NOT shortcut
, OR
+ AND
! NOTA list seperated by any of those will be transformed
These may be used with program, facility, pid, or host.
example: --program postfix,spamd
results: postfix OR spamdHOST AND, OR, or NOT shortcut
, OR
+ AND
! NOTA list of hosts seperated by any of those will be transformed. A host name should always end in a period unless it is a FQDN.
These may be used with host and src.
example: --src foo.,mail.bar.
results: /foo./ OR /mail.bar./
date
date
/^-/ appends "now" to it. So "-5m" becomes "now-5m".
/^u\:/ takes what is after ":" and uses Time::ParseDate to convert it to a unix time value.
Any thing not matching maching any of the above will just be passed on.