Статистика производительности ESX в Logstash

Вот пример ввода, вам просто понадобится rsyslog или инструмент ведения журнала для отправки журналов на входной порт (1514 в этом примере), а затем отфильтровать данные:

Ввод

input {
        tcp {
                type => "VMware"
                port => "1514"
        }
}

Фильтр

filter {
    if "VMware" in [tags] {
            multiline {
                    pattern => "-->"
                    what => "previous"
            }
            grok {
                    break_on_match => true
                    match => [
                            "message", "<%{POSINT:syslog_pri}>%{TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{SYSLOGPROG:syslog_program}: (?<message-body>(?<message_system_info>(?:\[%{DATA:message_thread_id} %{DATA:syslog_level} \'%{DATA:message_service}\'\ ?%{DATA:message_opID}])) \[%{DATA:message_service_info}]\ (?<syslog_message>(%{GREEDYDATA})))",
                            "message", "<%{POSINT:syslog_pri}>%{TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{SYSLOGPROG:syslog_program}: (?<message-body>(?<message_system_info>(?:\[%{DATA:message_thread_id} %{DATA:syslog_level} \'%{DATA:message_service}\'\ ?%{DATA:message_opID}])) (?<syslog_message>(%{GREEDYDATA})))",
                            "message", "<%{POSINT:syslog_pri}>%{TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{SYSLOGPROG:syslog_program}: %{GREEDYDATA:syslog_message}"
                    ]
            }
            syslog_pri { }
            date {
                    match => [ "syslog_timestamp", "YYYY-MM-ddHH:mm:ss,SSS" ]
                    timezone => "UTC"
            }
            mutate {
                    replace => [ "@source_host", "%{syslog_hostname}" ]
            }
            mutate {
                    replace => [ "@message", "%{syslog_message}" ]
            }
            if "Device naa" in [message] {
                    grok {
                            break_on_match => false
                            match => [
                                    "message", "Device naa.%{WORD:device_naa} performance has %{WORD:device_status}%{GREEDYDATA} of %{INT:datastore_latency_from}%{GREEDYDATA} to %{INT:datastore_latency_to}",
                                    "message", "Device naa.%{WORD:device_naa} performance has %{WORD:device_status}%{GREEDYDATA} from %{INT:datastore_latency_from}%{GREEDYDATA} to %{INT:datastore_latency_to}"
                            ]
                    }
            }
            if "connectivity issues" in [message] {
                    grok {
                            match => [
                                    "message", "Hostd: %{GREEDYDATA} : %{DATA:device_access} to volume %{DATA:device_id} %{DATA:datastore} (following|due to)"
                            ]
                    }
            }
            if "WARNING" in [message] {
                    grok {
                            match => [
                                    "message", "WARNING: %{GREEDYDATA:vmware_warning_msg}"
                            ]
                    }
            }
    }

}