filter-50-process.conf

filter {
  if [icinga][facility] == "Process" {
    if [message] =~ /^PID/ {
      grok {
        match => ["message","PID %{POSINT:[process][pid]} (\(%{DATA:[icinga][command]}\) )?(was )?terminated (by signal %{NUMBER:[icinga][signalcode]} \(%{WORD:[icinga][signaldetail]}\)|with exit code %{NUMBER:[icinga][exitcode]})"]
        id => "icinga_process_pidterminated"
        add_tag => "icinga_process_pidterminated"
        tag_on_failure => ["_grokparsefailure","icinga_process_pidterminated_failed"]
        add_field => {
          "[icinga][eventtype]" => "process_pid_terminated"
        }
      }
    } else if [message] =~ /^Running command/ {
      grok {
        match => ["message","Running command %{DATA:[icinga][command]}: PID %{POSINT:[process][pid]}"]
        id => "icinga_runningcommand"
        add_tag => "icinga_runningcommand"
        tag_on_failure => ["_grokparsefailure","icinga_runningcommand_failed"]
        add_field => {
          "[icinga][eventtype]" => "runningcommand"
        }
      }
    }
    grok {
      match => ["[icinga][command]","^%{QS:[file][path]}"]
      id => "icinga_runningcommanddetail"
      add_tag => "icinga_runningcommanddetail"
      tag_on_failure => ["_grokparsefailure","icinga_runningcommanddetail_failed"]
    }
  }
}