filter-50-legacytimeperiod.conf

filter {
  if [icinga][facility] == "LegacyTimePeriod" {
    if [message] =~ /^Legacy timeperiod update returned .+ segments\./ {
      grok {
        match => ["message","Legacy timeperiod update returned %{DATA:[icinga][count]}."]
        id => "icinga_legacytimeperiodupdate"
        add_tag => "icinga_legacytimeperiodupdate"
        tag_on_failure => ["_grokparsefailure","icinga_legacytimeperiodupdate_failed"]
        add_field => {
          "[icinga][eventtype]" => "legacy_timeperiod_update"
        }
      }
    } else if [message] =~ /^ParseTimeRange:/ {
      grok {
        match => ["message","ParseTimeRange: '%{WORD:[icinga][weekday]}' => %{NUMBER:[icinga][starttime]} -> %{NUMBER:[icinga][endtime]}, stride: %{NUMBER:[icinga][stride]}"]
        id => "icinga_parsetimerange"
        add_tag => "icinga_parsetimerange"
        tag_on_failure => ["_grokparsefailure","icinga_parsetimerange_failed"]
        add_field => {
          "[icinga][eventtype]" => "parse_time_range"
        }
      }
      date {
        match => ["[icinga][starttime]","UNIX"]
        target => "[icinga][starttime]"
      }
      date {
        match => ["[icinga][endtime]","UNIX"]
        target => "[icinga][endtime]"
      }
      mutate {
        add_field => {
          "[icinga][timerange]" => "%{[icinga][starttime]}-%{[icinga][endtime]}"
        }
      }
    }
  }
}