38 lines
972 B
Nix
38 lines
972 B
Nix
|
# filters nginx messages
|
||
|
|
{ config, ... }:
|
||
|
|
{
|
||
|
|
resource."graylog_pipeline_rule" = {
|
||
|
|
|
||
|
|
# not working for some reason
|
||
|
|
extractHttpCode = {
|
||
|
|
description = "extract thread information nginx access (TF)";
|
||
|
|
source = ''
|
||
|
|
rule "extract response code"
|
||
|
|
when
|
||
|
|
has_field("response_status")
|
||
|
|
then
|
||
|
|
set_field("response_status_description", lookup_value("http_codes_description", to_long($message.response_status)));
|
||
|
|
end
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
};
|
||
|
|
|
||
|
|
graylog.pipeline.processNginxMessage = {
|
||
|
|
source = ''
|
||
|
|
stage 99 match all
|
||
|
|
rule "extract response code";
|
||
|
|
'';
|
||
|
|
#streamId = config.graylog.all_messages.streamId;
|
||
|
|
#streamId = "\${data.graylog_stream.nginx.id}";
|
||
|
|
};
|
||
|
|
|
||
|
|
resource.graylog_pipeline_connection.processNginxMessage = {
|
||
|
|
stream_id = "\${data.graylog_stream.nginx.id}";
|
||
|
|
pipeline_ids = ["\${graylog_pipeline.processNginxMessage.id}"];
|
||
|
|
};
|
||
|
|
|
||
|
|
data.graylog_stream.nginx.title = "nginx";
|
||
|
|
|
||
|
|
}
|