Loading...

Generate random log events for logstash

:heavy_exclamation_mark: This post is older than a year. Consider some information might not be accurate anymore. :heavy_exclamation_mark:

Instead of using stdin, logstash also offers the generator input plugin for generating random log events. You can either use a single message or multiple messages in lines.

This logstash configuration generates emits a single time the defined message. You can check the performance of the filter plugin setup.

input {
    generator {
        type => 'metrics'
        message => '2015-09-29 09:36:28,574 metrics-memory-stat 2036334592;2147483648;2036334592;439658224'
        count => 1
    }
}
filter {
  if [type] == 'metrics' {
    grok {
        match => { 'message' => '(?<datetime>(%{TIMESTAMP_ISO8601})) (?<stat>(.*)) (?<data>(.*))' }
    }
    if [stat] == "metrics-memory-stat" {
        csv {
            source => "data"
            columns => ['heap-committed', 'heap-init', 'heap-max', 'heap-used']
            separator => ";"
        }
        mutate {
            convert => {
                "heap-committed" => "integer"
                "heap-init" => "integer"
                "heap-max" => "integer"
                "heap-used" => "integer"
            }
        }
    }
    date {
        match => [ 'datetime', 'yyyy-MM-dd HH:mm:ss,SSS', 'HH:mm:ss,SSS', 'ISO8601' ]
        remove_field => [ 'message', 'datetime', 'ISO8601_TIMEZONE', 'data' ]
    }
  }
}
output {
    stdout {
        codec => rubydebug{}
    }
}

This will result in

Logstash startup completed
{
          "@version" => "1",
        "@timestamp" => "2015-09-29T07:36:28.574Z",
              "type" => "metrics",
              "host" => "cinhtau",
          "sequence" => 0,
              "stat" => "metrics-memory-stat",
    "heap-committed" => 2036334592,
         "heap-init" => 2147483648,
          "heap-max" => 2036334592,
         "heap-used" => 439658224
}
Logstash shutdown completed