logstashelastic-stackfilebeat

Logstash + nginx: Fields wont be added

I'm going to Setup my own ELK Server to centralize logging. So far so good.

I Setup docker-compose.yml to run the ELK stack and another docker-compose.yml to run filebeat, which will watch logfiles, add env + tags and sent to logstash. The parsing should be made in logstash.

filebeat.yml

name: xyz

fields:
  env: xyz

output.logstash:
  hosts: ["xyz:5044"]

filebeat.prospectors:
  - input_type: log
    fields:
      app_id: default
      type: nginx-access
    tags:
      - nginx
      - access
    paths:
      - /logs/nginx/access.log*
  - input_type: log
    fields:
      app_id: default
      type: nginx-error
    tags:
      - nginx
      - error
    paths:
      - /logs/nginx/error.log*

and here's the logstash.yml

input {
  beats {
    port => 5044
  }
}

filter {
  if ["nginx"] in [tags] and ["access"] in [tags] {
    grok {
      patterns_dir => "/etc/logstash/patterns"
      match => { "message" => "%{NGINXACCESS}" }
    }

    date {
      match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
    }
  }
}

output {
  elasticsearch {
    hosts => ["elasticsearch:9200"]
  }
  stdout { codec => rubydebug }
}

The nginx-pattern is here

NGUSERNAME [a-zA-Z\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:indent} %{NGUSER:agent} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{URIPATHPARAM:request}(?: HTTP/%{NUMBER:httpversion})?|)\" %{NUMBER:answer} (?:%{NUMBER:byte}|-) (?:\"(?:%{URI:referrer}|-))\" (?:%{QS:referree}) %{QS:agent}

I tested the Expression on grokconstructor.appspot.com and it hits.

Here's a demo line:

127.0.0.1 - - [11/May/2017:13:49:31 +0200] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586" "-"

But no fields where added

enter image description here

I think maybe my "if" is wrong, but I tried several alternatives... nothing helped.

Any idea?

Solution

  • I will start by removing the if, then adding the conditions one by one. That is start with 

    ["nginx"] in [tags]

    and if that works, then go in for 

    ["nginx"] in [tags] and ["access"] in [tags]

    Alternatively you could try using 

    "nginx" in [tags] and "access" in [tags]

    UPDATE:

    To used fields.type = nginx-access, try

    "nginx-access" in [fields][type]