PuppetDB ELK

logback-access.xml

<configuration>
  <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
    <file>/var/log/puppetlabs/puppetdb/access.log</file>
    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
      <fileNamePattern>access.%d{yyyy-MM-dd}.log.zip</fileNamePattern>
    </rollingPolicy>

    <encoder>
      <pattern>%a %l %u [%t] "%r" %s %b "%i{Referer}" "%i{User-Agent}"</pattern>
    </encoder>
  </appender>

  <appender-ref ref="FILE" />
</configuration>

puppetdb-logstash.conf

input {
  file {
    path => "/var/log/puppetlabs/puppetdb/access.log"
    start_position => "beginning"
    sincedb_path => "/var/log/puppetlabs/puppetdb/.sincedb-puppetdb-logstash"
  }
  file {
    path => "/var/log/apache2/${::fqdn}_access_ssl.log"
    start_position => "beginning"
    sincedb_path => "/var/log/apache2/.sincedb-puppetdb-logstash"
  }
}

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
}

output {
  elasticsearch {
    index => "puppetdb_access-%{+YYYY.MM.dd}"
    hosts => "YOUR ES HOSTS HERE"
  }
}

puppetdb_access_mapping.json

{
    "template" : "puppetdb_access-*",
    "mappings" : {
        "_default_" : {
            "dynamic_templates" : [ {
                "string_fields" : {
                    "mapping" : {
                        "index" : "analyzed",
                        "omit_norms" : true,
                        "type" : "string",
                        "fields" : {
                            "raw" : {
                                "index" : "not_analyzed",
                                "ignore_above" : 256,
                                "type" : "string"
                            }
                        }
                    },
                    "match_mapping_type" : "string",
                    "match" : "*"
                }
            } ],
            "properties" : {
                "bytes" : {
                    "type" : "integer"
                },
                "response" : {
                    "type" : "integer"
                },
                "@version" : {
                    "index" : "not_analyzed",
                    "type" : "string"
                }
            }
        }
    }
}