Syslog hostname to allow underscores

fastlorenzo · Jul 17, 2020 · 9da4918 · 9da4918
1 parent 166a598
commit 9da4918
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/elkserver/logstash/conf.d/20-redir-haproxy.conf b/elkserver/logstash/conf.d/20-redir-haproxy.conf
@@ -46,7 +46,7 @@ filter {
 
     # Let's first trim the syslog info from the log line
     grok {
-      match => { "message" => ["%{SYSLOGTIMESTAMP:syslogtimestamp} %{SYSLOGHOST:sysloghostname} %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\])?: %{GREEDYDATA:messagenosyslog}"] }
+      match => { "message" => ["%{SYSLOGTIMESTAMP:syslogtimestamp} %{NOTSPACE:sysloghostname} %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\])?: %{GREEDYDATA:messagenosyslog}"] }
     }
 
 

diff --git a/elkserver/logstash/conf.d/30-redir-apache.conf b/elkserver/logstash/conf.d/30-redir-apache.conf
@@ -16,7 +16,7 @@ filter {
 
      # Let's first trim the syslog-like info from the log line
     grok {
-      match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{SYSLOGHOST:sysloghostname}|-) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
+      match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{NOTSPACE:sysloghostname}|-) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
     }
 
     # now matching the real Apache log lines. We have several log line formats we need to match:

diff --git a/elkserver/logstash/conf.d/40-redir-nginx.conf b/elkserver/logstash/conf.d/40-redir-nginx.conf
@@ -16,7 +16,7 @@ filter {
 
      # Let's first trim the syslog-like info from the log line
     grok {
-      match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{SYSLOGHOST:sysloghostname}|-) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
+      match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{NOTSPACE:sysloghostname}|-) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
     }
 
     # now matching the real Apache log lines. We have several log line formats we need to match:
-Original file line number
+Diff line change
@@ Expand Up / @@ -46,7 +46,7 @@ filter { @@
         # Let's first trim the syslog info from the log line
         grok {
-          match => { "message" => ["%{SYSLOGTIMESTAMP:syslogtimestamp} %{SYSLOGHOST:sysloghostname} %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\])?: %{GREEDYDATA:messagenosyslog}"] }
+          match => { "message" => ["%{SYSLOGTIMESTAMP:syslogtimestamp} %{NOTSPACE:sysloghostname} %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\])?: %{GREEDYDATA:messagenosyslog}"] }
         }
@@ Expand Down @@