40-grafana.conf

filter {

  if [fields][beats_output] == "grafana" {

    grok {
      patterns_dir  => "/etc/logstash/patterns.d"
      match         => { "message" => "%{GRAFANA}" }
      overwrite     => ["message"]
    }

    if [grafana][logger] =~ /^alerting\.resultHandler$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_ALERTING_RESULT}$" ]
            tag_on_failure => [ "_grok_grafana_alerting_resultHandler_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    } else if [grafana][logger] =~ /^alerting\.evalContext$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_ALERTING_EVAL}$" ]
            tag_on_failure => [ "_grok_grafana_evalContext_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    } else if [grafana][logger] =~ /^sqlstore$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_SQLSTORE}$" ]
            tag_on_failure => [ "_grok_grafana_sqlstore_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    } else if [grafana][logger] =~ /^plugins$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_PLUGINS}$" ]
            tag_on_failure => [ "_grok_grafana_plugins_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    } else if [grafana][logger] =~ /^plugins\.backend$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_PLUGINS_BACKEND}$" ]
            tag_on_failure => [ "_grok_grafana_plugins_backend_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    } else if [grafana][logger] =~ /^http\.server$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_HTTP_SERVER}$" ]
            tag_on_failure => [ "_grok_grafana_http_server_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    } else if [grafana][logger] =~ /^data-proxy-log$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_DATA_PROXY_LOG}$" ]
            tag_on_failure => [ "_grok_grafana_data_proxy_log_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }

    } else if [grafana][logger] =~ /^context$/ {
        grok {
            patterns_dir   => "/etc/logstash/patterns.d"
            match          => [ "message", "^%{GRAFANA_CONTEXT_ALL}$" ]
            tag_on_failure => [ "_grok_grafana_context_nomatch" ]
            add_tag        => [ "_grok_grafana_success" ]
        }
    }

    date {
      match           => [ "[grafana][timestamp]", "ISO8601" ]
      timezone        => "Europe/Berlin"
      locale          => "de"
      target          => "timestamp"
      remove_field    => ["[grafana][timestamp]"]
    }

    if [grafana][error][remote][addr] {
        geoip {
            source => "[grafana][error][remote][addr]"
            target => "[grafana][error][geoip]"
        }

        mutate {
            add_field => {"[grafana][error][remote][hostname]" => "%{[grafana][error][remote][addr]}"}
        }
        dns {
            reverse => [ "[grafana][error][remote][hostname]" ]
            action => "replace"
            hit_cache_size => 8000
            hit_cache_ttl => 300
            failed_cache_size => 1000
            failed_cache_ttl => 300
        }
    }

  }
}