filter-50-graphitewriter.conf

filter {
  if [icinga][facility] == "GraphiteWriter" {
    if [message] =~ /^Checkable '.+' adds to metric list: '.+'./ {
      grok {
        match => ["message","Checkable '%{DATA:[icinga][object]}' adds to metric list: '%{DATA:[icinga][metriclist]}'"]
        id => "icinga_checkableaddstometriclist"
        add_tag => "icinga_checkableaddstometriclist"
        tag_on_failure => ["_grokparsefailure","icinga_checkableaddstometriclist_failed"]
        add_field => {
          "[icinga][eventtype]" => "checkable_adds_to_metric_list"
        }
      }
    } else if [message] =~ /^Exception during Graphite operation: .+!/ {
      grok {
        match => ["message","Exception during Graphite operation: %{DATA:[icinga][message]}!"]
        id => "icinga_graphiteoperationexception"
        add_tag => "icinga_graphiteoperationexception"
        tag_on_failure => ["_gorkparsefailure","icinga_graphiteoperationexception_failed"]
        add_field => {
          "[icinga][eventtype]" => "graphite_operation_exception"
        }
      }
    } else if [message] =~ /^Reconnecting to Graphite on host .+ port '.+'./ {
      grok {
        match => ["message","Reconnecting to Graphite on host '%{DATA:[server][address]}' port '%{POSINT:[server][port]}'."]
        id => "icinga_reconnectingnographitehost"
        add_tag => "icinga_reconnectingnographitehost"
        tag_on_failure => ["_grokparsefailure","icinga_reconnectingnographitehost_failed"]
        add_field => {
          "[icinga][eventtype]" => "reconnecting_graphite_host"
        }
      }
    } else if [message] =~ /^Can't connect to Graphite on host .+ port '.+'.\nContext:\n\t\(.\) Reconnecting to Graphite '.+'/ {
      grok {
        match => ["message","Can't connect to Graphite on host '%{DATA:[server][address]}' port '%{POSINT:[server][port]}.\nContext:\n\t\(%{NUMBER}\) Reconnecting to Graphite '%{DATA:[icinga][name]}'"]
        id => "icinga_cannotconnecttographitehost"
        add_tag => "icinga_cannotconnecttographitehost"
        tag_on_failure => ["_grokparsefailure","icinga_cannotconnecttographitehost"]
        add_field => {
          "[icinga][eventtype]" => "can_not_connect_to_graphite_on_host"
        }
      }
    }
  }
}