start rules for notification logs

helps with #15
Icinga · May 10, 2019 · 263b18a · 263b18a
1 parent 98db46f
commit 263b18a
Showing 1 changed file with 26 additions and 0 deletions.
diff --git a/filter-50-notification.conf b/filter-50-notification.conf
@@ -0,0 +1,26 @@
+filter {
+  if [icinga][facility] == "Notification" {
+    if [message] =~ /^Sending / {
+      grok {
+        match => ["message","Sending '%{WORD:[icinga][notificationtype]}' notification '%{DATA:[icinga][notification]}' for user '%{DATA:[icinga][username]}'"]
+        id => "icinga_sendingnotification"
+        add_tag => "icinga_sendingnotification"
+        tag_on_failure => ["_grokparsefailure","icinga_sendingnotification_failed"]
+        add_field => {
+          "[icinga][eventtype]" => "sendingnotification"
+        }
+      }
+    } else if [message] =~ /^Completed sending / {
+      grok {
+        match => ["message","Completed sending '%{WORD:[icinga][notificationtype]}' notification '%{DATA:[icinga][notification]}' for checkable '%{DATA:[icinga][object]}' and user '%{DATA:[icinga][username]}'."]
+        id => "icinga_completedsendingnotification"
+        add_tag => "icinga_completedsendingnotification"
+        tag_on_failure => ["_grokparsefailure","icinga_completedsendingnotification_failed"]
+        add_field => {
+          "[icinga][eventtype]" => "completedsendingnotification"
+        }
+      }
+    }
+  }
+}
+