Second fix for Apache hyphen issue

Commit 02376d2 wasn't enough
outflanknl · Feb 12, 2020 · ec4dfca · ec4dfca
1 parent 02376d2
commit ec4dfca
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/elkserver/logstash/conf.d/30-redir-apache.conf b/elkserver/logstash/conf.d/30-redir-apache.conf
@@ -16,7 +16,7 @@ filter {
 
      # Let's first trim the syslog-like info from the log line
     grok {
-      match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{SYSLOGHOST:sysloghostname}|) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
+      match => { "message" => [ "\[%{HTTPDATE:redirtraffic.timestamp}\] (%{SYSLOGHOST:sysloghostname}|-) %{PROG:syslogprogram}(?:\[%{POSINT:syslogpid}\]): %{GREEDYDATA:messagenosyslog}" ] }
     }
 
     # now matching the real Apache log lines. We have several log line formats we need to match: