ELK Note (ElasticSearch-Logstash-Kibana)

 

 

logstash filter grok

https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html

logstash filter date

https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html

logstash filter translate

https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html

lostash filter mutate

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html

 

logstash debug config

.\logstash.bat -f dddd.conf

input {
    stdin{}
}

filter {
    grok {
      match => { "message" => "(\s(?<stock_id>[0-9]{5}))" }
    }
    date {
        locale => "en"
        match => ["message", "YYYY-MM-dd;HH:mm:ss.SSS"]
        timezone => "Europe/Vienna"
        target => "@timestamp"
        add_field => { "debug" => "timestampMatched"}
   }
}

output {
    stdout {
            codec => "rubydebug"
    }
}

http://blog.mmlac.com/how-to-pre-process-logs-with-logstash/

 

 

logstash timestamp issue fix

http://stackoverflow.com/questions/25156517/logstash-date-parsing-as-timestamp-using-the-date-filter

 

logstash IISLOG

Logstash config for IIS logs

http://dotnetanalysis.blogspot.tw/2014/11/logstash-config-for-iis-logs.html

URL

http://engineering.laterooms.com/enriching-logs-with-logstash/

.net+LogParser like logstash

TimberWinR 

 

 

 

Regular Expression Test

http://grokconstructor.appspot.com/do/match#result

 

HowTo install ELK on Windows Server IIS

https://blog.basefarm.com/blog/how-to-install-logstash-on-windows-server-2012-with-kibana-in-iis/