lusis/chef-logstash — pull request #28 by josephholsten (2012-10-05 06:21:19+00:00)
Title: rewrite config generation template to allow for complex inputs and filters

For example, I know have a logstash role of the following:

name 'logstash'

default_attributes(
logstash: {
graphite_role: "graphite",
elasticsearch_role: "elasticsearch",
server: {
enable_embedded_es: true,
inputs: [
{ tcp: { port: '514', type: 'syslog' }}
],
filters: [
{ grok: {
type: "syslog",
pattern: [ '<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}' ],
add_field: [ "received_at", "%{@timestamp}",
"received_from", "%{@source_host}" ] }},
{ syslog_pri: {
type: "syslog" }},
{ date: {
type: "syslog",
syslog_timestamp: [ "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ] }},
{ mutate: {
type: "syslog",
replace: [ "@source_host", "%{syslog_hostname}",
"@message", "%{syslog_message}" ] }},
{ mutate: {
type: "syslog",
remove: [ "syslog_hostname", "syslog_message", "syslog_timestamp" ] }}
]
}
}
)

run_list [
"role[base]",
"recipe[logstash::server]",
"recipe[logstash::kibana]"
]