filter-70-component.conf

filter {
  if ![icinga][eventtype] {
    if [message] =~ /started.$/ or [message] =~ /stopped.$/ or [message] =~ /resumed.$/ {
      grok {
        match => ["message","'%{DATA:[icinga][component][type]}' %{WORD:[icinga][component][status]}."]
        id => "icinga_component_started"
        add_tag => "icinga_component_status"
        tag_on_failure => ["_grokparsefailure","icinga_component_status_failed"]
        add_field => {
          "[icinga][eventtype]" => "component_status"
        }
      }
    }
  }
}