4 ## Add a id to plugin configuration. Can be anything unique.
7 ######## Connection configurations ########
9 ## The port to listen on.
10 port => {{.Values.service.externalPort}}
12 ## Close Idle clients after the specified time in seconds. Default is 60 seconds
13 #client_inactivity_timeout => 60
15 ######## Security configurations ########
17 ## Enable encryption. Default false.
20 ## ssl certificate path.
21 #ssl_certificate => $filebeat_ssl_certificate
24 #ssl_key => $filebeat_ssl_key
26 ##SSL key passphrase to use.
27 #ssl_key_passphrase => $filebeat_ssl_key_passphrase
29 ## Value can be any of: none, peer, force_peer.
30 #ssl_verify_mode => $filebeat_ssl_verify_mode
32 ## Time in milliseconds for an incomplete ssl handshake to timeout. Default is 10000 ms.
33 #ssl_handshake_timeout => 10000
34 include_codec_tag => false
41 break_on_match => false
43 "source" => ["/var/log/onap/(?<componentName>[^/]+)/",
44 "/var/log/onap/%{GREEDYDATA:componentLogFile}"
49 # Filter for log4j xml events
50 if "</log4j:event>" in [message] {
52 #mutate { add_field => { "orgmsg_log4j" => "%{message}" } } # Copy of orginal msg for debug
54 #Filter to parse xml event and retrieve data
58 remove_namespaces => true
59 target => "xml_content"
60 xpath => [ "/event/message/text()", "logmsg" ,
61 "/event/@logger", "Logger",
62 "/event/@timestamp", "Timestamp",
63 "/event/@level", "loglevel",
64 "/event/@thread", "Thread",
65 "/event/throwable/text()", "Exceptionthrowable",
66 "/event/NDC/text()", "NDCs",
67 "/event/properties/data/@name","mdcname",
68 "/event/properties/data/@value","mdcvalue"]
72 #Ruby filter to iterate and separate MDCs into documents
77 if event.get("[mdcname]")
78 $num = event.get("[mdcname]").length
82 if event.get("[mdcname]").at($i) and event.get("[mdcvalue]").at($i)
83 event.set(event.get("[mdcname]").at($i), event.get("[mdcvalue]").at($i))
92 if [Exceptionthrowable]
96 "exceptionmessage" => "%{[Exceptionthrowable]}"
112 "Logger" =>"%{[Logger]}"
113 "logmsg" =>"%{[logmsg]}"
114 "Timestamp" =>"%{[Timestamp]}"
115 "loglevel" =>"%{[loglevel]}"
116 "message" => "%{logmsg}"
117 "Thread" => "%{[Thread]}"
119 remove_field => ["mdcname", "mdcvalue", "logmsg","Exceptionthrowable","NDCs"]
125 match => ["Timestamp", "UNIX_MS"]
126 target => "Timestamp"
130 # Filter for logback events
133 #mutate { add_field => { "orgmsg" => "%{message}" } } # Copy of orginal msg for debug
137 'message', ' = ', '=',
138 'message', '= ', '=null',
139 'message', '=\t', '=null ', #This null is followed by a tab
140 'message', '\t$', '\t'
143 # The grok below parses the message field for all current logback patterns used by oom components.
144 # Example logback pattern: %d{"yyyy-MM-dd'T'HH:mm:ss.SSSXXX", UTC}|%X{RequestId}|%msg
145 # Example grok pattern: %{TIMESTAMP_ISO8601:Timestamp}\|%{UUID:RequestId}\|%{GREEDYDATA:message}
146 # Use the following command to find all logback patterns in oom directory: find oom -name "logback*xml" -exec grep "property.*attern.*value" {} \;|sort|uniq
150 "%{TIMESTAMP_ISO8601:Timestamp}\\t[%{GREEDYDATA:Thread}]\\t%{GREEDYDATA:loglevel}\\t%{JAVACLASS:Logger}\\t%{GREEDYDATA:MDCs}\\t%{GREEDYDATA:message}",
151 "%{TIMESTAMP_ISO8601:BeginTimestamp}\|%{TIMESTAMP_ISO8601:EndTimestamp}\|%{UUID:RequestId}\|%{GREEDYDATA:ServiceInstanceId}\|%{GREEDYDATA:Thread}\|%{GREEDYDATA:Unknown1}\|%{GREEDYDATA:ServiceName}\|%{GREEDYDATA:PartnerName}\|%{GREEDYDATA:TargetEntity}\|%{GREEDYDATA:TargetServiceName}\|%{GREEDYDATA:StatusCode}\|%{GREEDYDATA:ResponseCode}\|%{GREEDYDATA:ResponseDesc}\|%{UUID:InstanceUUID}\|%{GREEDYDATA:loglevel}\|%{GREEDYDATA:AlertSeverity}\|%{IP:ServerIPAddress}\|%{GREEDYDATA:Timer}\|%{HOSTNAME:ServerFQDN}\|%{IPORHOST:RemoteHost}\|%{GREEDYDATA:Unknown2}\|%{GREEDYDATA:Unknown3}\|%{GREEDYDATA:Unknown4}\|%{GREEDYDATA:TargetVirtualEntity}\|%{GREEDYDATA:Unknown5}\|%{GREEDYDATA:Unknown6}\|%{GREEDYDATA:Unknown7}\|%{GREEDYDATA:Unknown8}\|%{GREEDYDATA:message}",
152 "%{TIMESTAMP_ISO8601:BeginTimestamp}\|%{TIMESTAMP_ISO8601:EndTimestamp}\|%{UUID:RequestId}\|%{GREEDYDATA:ServiceInstanceId}\|%{GREEDYDATA:Thread}\|%{GREEDYDATA:Unknown1}\|%{GREEDYDATA:ServiceName}\|%{GREEDYDATA:PartnerName}\|%{GREEDYDATA:StatusCode}\|%{GREEDYDATA:ResponseCode}\|%{GREEDYDATA:ResponseDesc}\|%{UUID:InstanceUUID}\|%{GREEDYDATA:loglevel}\|%{GREEDYDATA:AlertSeverity}\|%{IP:ServerIPAddress}\|%{GREEDYDATA:Timer}\|%{HOSTNAME:ServerFQDN}\|%{IPORHOST:RemoteHost}\|%{GREEDYDATA:Unknown2}\|%{GREEDYDATA:Unknown3}\|%{GREEDYDATA:Unknown4}\|%{GREEDYDATA:Unknown5}\|%{GREEDYDATA:Unknown6}\|%{GREEDYDATA:Unknown7}\|%{GREEDYDATA:Unknown8}\|%{GREEDYDATA:message}",
153 "%{TIMESTAMP_ISO8601:Timestamp}\|%{UUID:RequestId}\|%{GREEDYDATA:ServiceInstanceId}\|%{GREEDYDATA:Thread}\|%{GREEDYDATA:ServiceName}\|%{UUID:InstanceUUID}\|%{GREEDYDATA:loglevel}\|%{GREEDYDATA:AlertSeverity}\|%{IP:ServerIPAddress}\|%{HOSTNAME:ServerFQDN}\|%{IPORHOST:RemoteHost}\|%{GREEDYDATA:Timer}\|\[%{GREEDYDATA:caller}\]\|%{GREEDYDATA:message}",
154 "%{TIMESTAMP_ISO8601:Timestamp}\|%{GREEDYDATA:RequestId}\|%{GREEDYDATA:Thread}\|%{GREEDYDATA:ServiceName}\|%{GREEDYDATA:PartnerName}\|%{GREEDYDATA:TargetEntity}\|%{GREEDYDATA:TargetServiceName}\|%{GREEDYDATA:loglevel}\|%{GREEDYDATA:ErrorCode}\|%{GREEDYDATA:ErrorDesc}\|%{GREEDYDATA:message}",
155 "%{TIMESTAMP_ISO8601:Timestamp}\|%{GREEDYDATA:RequestId}\|%{GREEDYDATA:Thread}\|%{GREEDYDATA:ClassName}\|%{GREEDYDATA:message}",
156 "%{TIMESTAMP_ISO8601:Timestamp}\|%{UUID:RequestId}\|%{GREEDYDATA:message}",
157 "\[%{TIMESTAMP_ISO8601:Timestamp}\|%{LOGLEVEL:loglevel}\|%{GREEDYDATA:Logger}\|%{GREEDYDATA:Thread}\] %{GREEDYDATA:message}"
160 overwrite => ["message"]
162 # The MDCs are key value pairs that are seperated by "," or "\t". Extra space characters are trimmed from the keys and values.
168 remove_field => [ "MDCs" ]
171 if (![Timestamp] and [EndTimestamp]) {
172 mutate { add_field => { "Timestamp" => "%{EndTimestamp}" } }
175 match => [ "Timestamp", "ISO8601", "yyyy-MM-dd HH:mm:ss,SSS" ]
176 target => "Timestamp"
180 remove_field => ["DuplicateRequestID", "Unknown1", "Unknown2", "Unknown3", "Unknown4", "Unknown5", "Unknown6", "Unknown7", "Unknown8"]
183 if ([source] == "/var/log/onap/sdc/sdc-be/audit.log") {
184 #Parse kvps in message
191 #If Request Id is missing and DID is present use as RequestId
192 if (![RequestId] and [DID] =~ /.+/) {
193 mutate { add_field => { "RequestId" => "%{DID}" } }
197 } #Close else statement for logback events
205 ######### Security configurations #########
208 password => "changeme"
210 ## The .cer or .pem file to validate the server's certificate
211 #cacert => $es_cacert
213 ## The keystore used to present a certificate to the server. It can be either .jks or .p12
214 #keystore => $es_keystore
215 #keystore_password => $es_keystore_password
217 ## Enable SSL/TLS secured communication to Elasticsearch cluster.
218 ## Default is not set which in that case depends on the protocol specidfied in hosts list
221 ## Option to validate the server's certificate. Default is true
222 #ssl_certificate_verification => $es_ssl_certificate_verification
224 ## The JKS truststore to validate the server's certificate.
225 #truststore => $es_truststore
226 #truststore_password => $es_truststore_password
229 ######### Elasticsearchcluster and host configurations #########
231 ##can specify one or a list of hosts. If sniffing is set, one is enough and others will be auto-discovered
232 hosts => ["http://{{.Values.config.elasticsearchServiceName}}.{{.Release.Namespace}}:{{.Values.config.elasticsearchPort}}"]
235 ## This setting asks Elasticsearch for the list of all cluster nodes and adds them to the hosts list. Default is false.
238 ## How long to wait, in seconds, between sniffing attempts. Default is 5 seconds.
241 ## Set the address of a forward HTTP proxy.
244 ##Use this if you must run Elasticsearch behind a proxy that remaps the root path for the Elasticsearch HTTP API lives
247 ######### Elasticsearch request configurations #########
249 ## This setting defines the maximum sized bulk request Logstash will make.
252 ######### Document configurations #########
254 index => "logstash-%{+YYYY.MM.dd}"
255 document_type => "logs"
257 ## This can be used to associate child documents with a parent using the parent ID.