iac
/
syslog-ng
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add nginx log config

This commit is contained in:
Kameron Kenny 2024-06-21 14:27:38 -04:00
parent c35324b3e1
commit 1bba05a537
No known key found for this signature in database
GPG Key ID: E5006629839D2276
3 changed files with 74 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Dockerfile
View File

@ -1,7 +1,7 @@
FROM debian:latest
MAINTAINER Kameron Kenny <kkenny379@gmail.com>
LABEL version="20240621.1.2"
LABEL version="20240621.2.1"
LABEL description="Debian Based syslog-ng"
RUN apt-get update

72
config/syslog-ng.conf.d/nginx.conf Normal file
View File

@ -0,0 +1,72 @@
filter f_nginx { match("nginx" value("PROGRAM")); };
rewrite r_docker_image {
subst("^5000/tlp/", "image:", value("MESSAGE"));
subst(":(?=(\d*\.\d*\.\d*))", " version:", value("MESSAGE"));
subst('(\/)(?=\S*\[)', " container_name:", value("MESSAGE"));
subst('((?!=container_name:(\S*))\[(?=\d*))', " pid:", value("MESSAGE"));
subst('((?!=pid:(\d*))\]:)', "", value("MESSAGE"));
subst('((?!=pid:(\d*))\ )', " datetime:", value("MESSAGE"));
subst('((?!=datetime:(\d*-\w*-\d*))\ )', "_", value("MESSAGE"));
subst('((?!=datetime:(\d*-\w*-\d*_\d*)):)', ".", value("MESSAGE"));
subst('((?!=datetime:(\d*-\w*-\d*_\d*\.\d*)):)', ".", value("MESSAGE"));
};
parser p_nginx_message {
csv-parser(
dialect(escape-double-char)
flags(strip-whitespace)
delimiters(" ")
quote-pairs('""[]')
columns("docker", "nginx.client.ip", "nginx.ident", "nginx.auth", "nginx.timestamp", "nginx.request", "nginx.response", "nginx.bytes", "nginx.referrer", "nginx.agent")
);
};
rewrite r_docker_header {
subst(":", " ", value("docker"));
subst("\/", " ", value("docker"));
subst('\[', " ", value("docker"));
subst('\]', " ", value("docker"));
};
parser p_docker_header {
csv-parser(
template("${docker}")
flags(strip-whitespace)
delimiters(" ")
columns("docker.image.name", "docker.container.name", "docker.container.pid")
);
};
parser p_nginx_client_ip_geoip2_city {
geoip2(
"${nginx.client.ip}",
prefix( "geoip2.source." )
database( "/config/GeoIP/GeoLite2-City.mmdb" )
);
};
destination d_nginx_logs {
elasticsearch-http(
index("nginx-logs")
type("")
user("elastic")
password("forty6and2")
url("http://pi501.in.thelinuxpro.net:9200/_bulk")
template("$(format-json --scope rfc5424 --scope dot-nv-pairs
--rekey .* --shift 1 --scope nv-pairs
--exclude DATE @timestamp=${ISODATE})")
persist-name("d_nginx_logs")
);
};
log {
source(s_network_udp);
filter(f_nginx);
parser(p_nginx_message);
rewrite(r_docker_header);
parser(p_docker_header);
parser(p_nginx_client_ip_geoip2_city);
destination(d_nginx_logs);
flags(final);
};

2
docker-compose.yml
View File

@ -10,7 +10,7 @@ services:
syslog-ng:
build:
dockerfile: Dockerfile
image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240621.1.2
image: docker-registry1.in.thelinuxpro.net:5000/tlp/syslog-ng:240621.2.1
container_name: syslog-ng
restart: unless-stopped
networks: