# 在Logslash 中設定讀取 Laravel Log 檔案

vi /etc/logstash/conf.d/10-laravel-log-filter.conf

input {
#  beats {
#    port => 5044
#  }
  file {
    path => "/var/www/html/elasticsearch/storage/logs/laravel*.log"
    start_position => "beginning"
    type => "laravel"
    codec => multiline {
      pattern => "^\[%{TIMESTAMP_ISO8601}\] "
      negate => true
      what => previous
      auto_flush_interval => 10
    }
    add_field => {"stack" => "tether"}
  }
}
filter {
  if [type] == "laravel" {
    grok {
      match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{DATA:severity}: %{GREEDYDATA:message}" }
    }
    ruby {
      code => "event.set('ip', `ip a s eth0 | awk \'/inet / {print$2}\'`)"
    }
    mutate {
      add_field => { "sns_subject" => "%{stack} Alert (%{env} - %{ip})" }
    }
    date {
      match => [ "timestamp", "yyyy-MM-dd HH:mm:ss" ]
      target => "@timestamp"
    }
  }
}
output {
  if [type] == "laravel" {
    elasticsearch {
      hosts => ["127.0.0.1:9200"]
      index => "laravellog"
      user => "elastic"
      password => "changeme" }
  }
  else {
    elasticsearch {
      hosts => ["localhost:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  }
}

###### tags: `Logslash`