-
Notifications
You must be signed in to change notification settings - Fork 3.5k
/
azure.conf.erb
59 lines (52 loc) · 1.52 KB
/
azure.conf.erb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License;
# you may not use this file except in compliance with the Elastic License.
input{
<%=
deprecation_logger.deprecated("The Azure module has been deprecated in favor of the Beats Azure module, and may be removed in a future release. Learn more about the Beats Azure module at https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-azure.html")
require 'azure_module_config_generator'
config_generator = LogStash::Azure::ConfigGenerator.new
config_generator.generate_input(@settings)
%>
}
filter {
json {
source => "message"
}
if "_jsonparsefailure" not in [tags] {
split {
field => "records"
target => "data"
}
if "_split_type_failure" not in [tags] {
ruby{
code => "
event.get('data').each { |k,v|
event.set(k, v)
}
event.remove('data')
"
remove_field => ["message", "records"]
}
if "_rubyexception" not in [tags] {
azure_event{}
if "_azure_event_failure" not in [tags] {
if [callerIpAddress]{
geoip {
source => "callerIpAddress"
}
}
date {
match => [ "time", "ISO8601" ]
}
mutate {
copy => { "@metadata" => "[azure][metadata]" }
}
}
}
}
}
}
output {
<%= elasticsearch_output_config('_doc') %>
}