filter-50-httpserverconnection.conf

filter {
  if [icinga][facility] == "HttpServerConnection" {
    if [message] =~ /^HTTP client disconnected .+from/ {
      grok {
        match => ["message","HTTP client disconnected \(from \[%{IP:[client][ip]}\]:%{POSINT:[client][port]}\)"]
        id => "icinga_httpclientdisconnected"
        add_tag => "icinga_httpclientdisconnected"
        tag_on_failure => ["_grokparsefailure","icinga_httpclientdisconnected_failed"]
        add_field => {
          "[icinga][eventtype]" => "http_client_disconnected"
        }
      }
    } else if [message] =~ /^Request: GET .+, user: .+/ {
      # do not use pattern USERNAME for api user, because sometimes it's just "<unauthenticated>"
      grok {
        match => ["message","Request: %{WORD:[http][request][method]} %{URIPATHPARAM:[icinga][apirequest]} \(from \[%{IP:[client][ip]}\]:%{POSINT:[client][port]}\), user: %{DATA:[user][name]}(, agent: %{DATA:[user_agent][original]})?"]
        id => "icinga_httprequest"
        add_tag => "icinga_httprequest"
        tag_on_failure => ["_grokparsefailure","icinga_httprequest_failed"]
        add_field => {
          "[icinga][eventtype]" => "httprequest"
        }
      }
    } else if [message] =~ /^Unauthorized request:/ {
      grok {
        match => ["message","Unauthorized request: %{WORD:[http][request][method]} %{URIPATHPARAM:[icinga][apirequest]}%{GREEDYDATA:[icinga][context]}"]
        id => "icinga_unauthorizedrequestget"
        add_tag => "icinga_unauthorizedrequestget"
        tag_on_failure => ["_grokparsefailure","icinga_unauthorizedrequestget_failed"]
        add_field => {
          "[icinga][eventtype]" => "icinga_unauthorizedrequestget"
        }
      }
    }
  }
}