@version: 3.7
@include "scl.conf"
#PROXY_STRING + single space + INET_PROTOCOL + single space + CLIENT_IP + single space + PROXY_IP + single space + CLIENT_PORT + single space + PROXY_PORT + "\r\n"
python {
import socket
import json
def aws_elb_proxy_protocol2json(logmsg, arg):
out = {}
token_separator = ' '
tokens = arg.split(token_separator)
if not tokens or len(tokens) < 6:
return json.dumps({"aws_elb_proxy_protocol2json.error": "split failure", "message": arg})
out["proxy"] = tokens[0]
out["inet_protocol"] = tokens[1]
out["client_ip"] = tokens[2]
out["proxy_ip"] = tokens[3]
out["client_port"] = tokens[4]
out["proxy_port"] = tokens[5]
return json.dumps(out)
};
block parser aws_elb2json (
template("${MSG}")
rec-sep(' ')
field-sep(' ')
) {
json-parser(template("$(python aws_elb_proxy_protocol2json `template`)"));
};
source s_aws_elb {
file("/tmp/aws-elb.log" flags(no-parse));
};
destination d_client_port_odd_json {
file("/tmp/aws_elb_client_port_odd_json.log" template("$(format-json -s nv-pairs)\n"));
};
destination d_client_port_even {
#file("/tmp/aws_elb_client_port_even.log" template("$(format-json -s nv-pairs)\n"));
file("/tmp/aws_elb_client_port_even.log");
};
filter f_client_port_odd { match("\d*[13579]$" value("client_port")); };
filter f_client_port_even { match("\d*[02468]$" value("client_port")); };
log {
source(s_aws_elb);
parser { aws_elb2json(); };
filter(f_client_port_odd);
destination(d_client_port_odd_json);
};
log {
source(s_aws_elb);
parser { aws_elb2json(); };
filter(f_client_port_even);
destination(d_client_port_even);
};
L.