k3/longrunning.conf at master · mk051191/k3 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
input {
file {
path => "/opt/longrun/*"
start_position => "beginning"
ignore_older => 0
type => "m"
sincedb_path => "/dev/null"
}
}
filter {
 csv {
     separator => ","
    columns => ["Job ID", "Master Server", "Type", "Destination Media Server", "State", "Status", "Policy", "State Details", "Start Time", "Client", "Job Size", "Files", "Elapsed Time", "End Time", "% Complete", "Source Media Server", "Policy Type", "Parent"]

  }
date {
    match => ["Start Time", "MMM dd, yyyy hh:mm:ss aa"]
    target => "Start Time"

  }

csv {
     # hour:min:second
     columns => [ "hours", "minutes", "seconds"]
     source => "Elapsed Time"
     separator => ":"
}

 ruby {
        code => "event.set('duration', ( (event.get('hours').to_f )   + event.get('minutes').to_f / 60 + (event.get('seconds').to_f / 3600 ) ))"
 }


     mutate {convert =>  ["Elapsed Time", "integer_eu"] }
     mutate {convert =>  ["Job Size", "float"] }
     mutate {convert =>  ["% Complete", "integer"] }
     mutate {convert =>  ["Parent", "integer"] }
     mutate {convert =>  ["Elapsed Time", "integer_eu"] }
     mutate {convert =>  ["Status", "integer"] }
     mutate {convert =>  ["Files", "integer"] }


}

output {

if [type] == "m" {

   elasticsearch {
     hosts => ["10.5.112.121:9200", "10.5.112.122:9200"]
     index => "longrun"
     document_type => "backup"
     document_id => "%{Job ID}"
  }
stdout {codec => rubydebug}
}
}