nsyslog/examples/config/test051_machine.json

Modular new generation log agent. Reads, transform, aggregate, correlate and send logs from sources to destinations

{
	"config" : {
		"datadir" : "/tmp/nsyslog",
		"input" : {"buffer" : 100},
		"collector" : {
			"key" : "ctx",
			"ival" : 1000
		}
	},

	"inputs" : {
		"_monitor_ctx_stats" : {
			"type" : "machine",
			"config" : {
			}
		}
	},

	"processors" : {
		"_monitor_ctx_evtmem" : {
			"type" : "properties",
			"config" : {
				"set" : {
					"event" : {
						"sip" : "@setp:sender@",
						"res" : "${originalMessage.hostname}",
						"subres" : "MonitorStats",
						"evt" : "MONITOR_MEM",
						"ct1" : "${originalMessage.sysUpTime}",
						"ct2" : "${originalMessage.memory.total/(1024*1024)}",
						"ct3" : "${originalMessage.memory.free/(1024*1024)}",
						"ct5" : "${originalMessage.platform}",
						"ct6" : "${originalMessage.arch}",
						"pn" : "${originalMessage.os.version}/${originalMessage.os.release}"	
					}
				}
			}
		},
		"_monitor_ctx_evtcpu" : {
			"type" : "properties",
			"config" : {
				"set" : {
					"event" : {						
						"sip" : "@setp:sender@",
						"res" : "${originalMessage.hostname}",
						"subres" : "MonitorStats",
						"evt" : "MONITOR_CPU",
						"ct1" : "${originalMessage.sysUpTime}",
						"ct2" : "${originalMessage.cpuLoad.min1}",
						"ct3" : "${originalMessage.cpuLoad.min5}",
						"ct4" : "${originalMessage.cpuLoad.min15}",
						"ct5" : "${originalMessage.platform}",
						"ct6" : "${originalMessage.arch}",
						"pn" : "${originalMessage.os.version}/${originalMessage.os.release}"	
					}
				}
			}
		},
		"win_discard_user": {
			"type": "properties",
			"config": {},
			"when": {
				"filter": {
					"$and": [
						{"$expr":{"$eval":"${evt.ct5.indexOf('logagent.exe')} <= 0"}}
					]
				},
				"match": "bypass",
				"nomatch": "block"
			}
		}		
	},

	"transporters" : {
		"console" : {
			"type" : "console",
			"attach" : ["flow1"],
			"config" : {
				"format" : "${JSON:event}",
				"json" : {
					"format" : true,
					"spaces" : 2,
					"color" : true
				}
			}
		},
		"null" : {
			"type" : "null"
		}
	},

	"flows" : [
		{
			"id":"_monitor_ctx_mem", "from":"_monitor_ctx_stats", "fork":false, 
			"children" : [
				{"processors":["_monitor_ctx_evtmem","win_discard_user"], "transporters":"console"},
				{"processors":["_monitor_ctx_evtcpu","win_discard_user"], "transporters":"console"}
			]			
			
		}
	]
}