Prerequisites

Inputs configuration

1. Reading a file

   In this file, you must add the logstash configuration to read the contents of all log files starting with: "/var/log/rousseltm/advanced-".
   
   You must add a type for this file with the value 'advanced'.

Filters configuration

1. Data extraction

   You must identify the most suitable filter for a flat file and put the configuration that will extract the fields from the previously read log files knowing that these files are made up of several log formats.

2. Type modification

   We want to convert the "HTTP_CODE" field to an integer. Indeed, there are often arithmetic operations on this field when making restitutions (dashboard, alerts...). For example, display all codes between 200 and 205.

3. Field deletion

   We will remove the message field as we have already extracted the information that interests us.

Outputs configuration

1. Writing to a file

   In this file, you must update the logstash configuration so that it writes the logs to the file that corresponds to its 'type'