start rules for "process" logs

helps with #17
Icinga · May 10, 2019 · 153b400 · 153b400
1 parent df7b3bb
commit 153b400
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/filter-50-process.conf b/filter-50-process.conf
@@ -0,0 +1,16 @@
+filter {
+  if [icinga][facility] == "Process" {
+    if [message] =~ /PID/ {
+      grok {
+        match => ["message","PID %{POSINT:[icinga][pid]} was terminated by signal %{POSINT:[icinga][signal][code]} \({%{WORD:[icinga][signal][detail]}\)"]
+        id => "icinga_process_pidterminated"
+        add_tag => "icinga_process_pidterminated"
+        tag_on_failure => ["_grokparsefailure","icinga_process_pidterminated_failed"]
+        add_field => {
+          "[icinga][eventtype]" => "process_pidterminated"
+        }
+      }
+    }
+  }
+}
+