hyphen hostname issue in Apache
When not explicitly configured, Apache can use a hyphen as hostname. The default %{SYSLOGHOST} grok directive doesn't seem to like this.
@@ -16,7 +16,7 @@ filter {
# Let's first trim the syslog-like info from the log line
grok {
- match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] %{SYSLOGHOST:sysloghostname} %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
+ match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{SYSLOGHOST:sysloghostname}|) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
}
# now matching the real Apache log lines. We have several log line formats we need to match:
