Skip to content

Latest commit

 

History

History
15 lines (11 loc) · 690 Bytes

ALTERNATIVE-INPUTS.md

File metadata and controls

15 lines (11 loc) · 690 Bytes
Raw

Adapt alternative inputs

Various other Logstash filters can produce the needed input fields (program and message) for the postfix grok patterns too, with a little help. You can simply include the lines listed below in a file named 49-filter-postfix-prepare.conf (or something else to your liking, as long as it's alphabetically listed before the 50-filter-postfix.conf file).

Beats/Filebeat

grok {
    match => { "message" => "%{SYSLOGTIMESTAMP} %{SYSLOGHOST} %{DATA:program}(?:\[%{POSINT}\])?: %{GREEDYDATA:message}" }
    overwrite => "message"
}