apache.conf

input {
  file {
    path => "/var/log/httpd/access_log"
    stat_interval => 0.01
    type => "apache_access"
  }
}


filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
  if [request] =~ /^\/api\/\S+/ {
#    drop {}
    mutate { add_tag => [ "api" ] }
  }
  metrics {
    meter => "events"
#    meter => [ "http.%{response}" ]
    add_field => {
      "type" => "meter"
      "host" => "%{message}"
    }
    add_tag => [ "apache" ]
    ignore_older_than => 10
  }
  metrics {
    timer => [ "render_time", "%{time}" ]
    add_tag => [ "timer" ]
  }
}

output {
  if "api" not in [tags] {
    redis {
      host => "py-adm"
      data_type => "list"
      key => "logstash"
    }
  }
  zeromq {
    address  => "tcp://py-dev:5500"
    topic    => "lapb"
    topology => "pubsub"
  }
}