Hi All,

Anybody has a nice example for the loggs of ovirt for logstash?

I'm using this one now:

filter {
if [type] == "ovirt" {
    grok {
      match => { "message" => "\A%{TIMESTAMP_ISO8601}%{JAVAFILE}%{SYSLOG5424SD}%{GREEDYDATA}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_tag => [ "ovirt" ]
      tag_on_failure => []
    }
    date {
      match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
      }
    }
}

But I have got a grokparse failure in this one... So I was thinking maybe one of the community has something way better then this? :-)

Kind regards,

Koen