Small elasticsearch fixups

diff --git a/doc/schemas/logstash/README b/doc/schemas/logstash/README
index d46022d..93b937c 100644 (file)
--- a/doc/schemas/logstash/README
+++ b/doc/schemas/logstash/README
@@ -41,13 +41,23 @@ radius.conf
   It processes these by joining each record onto one line, then splitting the
   tab-delimited key-value pairs out.
 
-  The file will need to be edited at least to set the input method. For
+  The file will need to be edited at least to set the input method: for
   experimentation the given input (stdin) may be used. If logstash is running on
   the RADIUS server then 'file' input may be appropriate, otherwise a different
   input such as log-courier or logstash-forwarder may be better to get the data
   over the network to the logstash server.
 
 
+Example usage
+-------------
+
+Install mapping (only needs to be done once):
+$ ./radius-mapping.sh
+
+Feed a detail file in:
+$ /path/to/logstash -f radius.conf < acct-detail
+
+
 See also
 --------
 

diff --git a/doc/schemas/logstash/radius-mapping.sh b/doc/schemas/logstash/radius-mapping.sh
index dfaf8bd..25f7071 100644 (file)
--- a/doc/schemas/logstash/radius-mapping.sh
+++ b/doc/schemas/logstash/radius-mapping.sh
@@ -20,8 +20,9 @@ curl -XPUT '127.0.0.1:9200/_template/radius' -d '
               "type":"string",
               "index":"analyzed"
             }
-          },
-          "no_analyze_strings":{
+          }
+        },
+        { "no_analyze_strings":{
             "match":"*",
             "match_mapping_type":"string",
             "mapping":{

diff --git a/doc/schemas/logstash/radius.conf b/doc/schemas/logstash/radius.conf
index 9b5a8e9..a837fa3 100644 (file)
--- a/doc/schemas/logstash/radius.conf
+++ b/doc/schemas/logstash/radius.conf
@@ -23,11 +23,11 @@
 # is stored as a separate field in the output document.
 
 
-#input {
-#  stdin {
-#    type => radiusdetail
-#  }
-#}
+input {
+  stdin {
+    type => radiusdetail
+  }
+}
 
 
 filter {
@@ -43,12 +43,13 @@ filter {
 
        # pull off the timestamp
        grok {
-               match => [ "message", "^(?<timestamp>[^\t]+)\t" ]
+               match => [ "message", "^(?<timestamp>[^\n\t]+)[\n\t]" ]
        }
 
        # create the timestamp field
        date {
-               match => [ "timestamp", "E MMM dd HH:mm:ss yyyy" ]
+               match => [ "timestamp", "EEE MMM dd HH:mm:ss yyyy",
+                                       "EEE MMM  d HH:mm:ss yyyy" ]
        }
 
        # split the attributes and values into fields