Commit 10b04c00 authored by Douglas Barbosa Alexandre's avatar Douglas Barbosa Alexandre

Merge branch '14707-filebeat-parse-modsec-logs-as-json' into 'master'

Update filebeat managed app to parse modsec logs as JSON

See merge request gitlab-org/gitlab!24836
parents a0c008dc dbc82d41
---
title: Parse filebeat modsec logs as JSON
merge_request: 24836
author:
type: changed
......@@ -23,6 +23,29 @@ filebeat:
output.elasticsearch:
enabled: true
hosts: ["http://elastic-stack-elasticsearch-client:9200"]
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/*.log
- /var/log/messages
- /var/log/syslog
- type: docker
containers.ids:
- "*"
json.keys_under_root: true
json.ignore_decoding_error: true
processors:
- add_kubernetes_metadata:
- drop_event:
when:
equals:
kubernetes.container.name: "filebeat"
- decode_json_fields:
fields: ["message"]
when:
equals:
kubernetes.container.name: "modsecurity-log"
fluentd:
enabled: false
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment