EBEGU-1916: Logstash-Kategorisierung (Tags) korrigiert und ausgebaut

logstash/conf.d/30-logstash-categorize.conf

@@ -1,28 +1,71 @@
 filter {
-	if [type] == "ebegu" {
-		# z.B.
-		# Managed Bean [class ch.dvbern.tax.common.engine.util.DiagnosticModelVisitor$ModelTuple] with qualifiers [@Any @Default]
-		# Producer Method [FlowBuilder] with qualifiers [@FlowBuilderParameter @Any] declared as [[UnbackedAnnotatedMethod] @Produces @FlowBuilderParameter public org.apache.myfaces.flow.cdi.FlowBuilderFactoryBean.createFlowBuilderInstance()]
-		# Session bean [class ch.dvbern.tax.stip.integration.dao.ejb.ConfigurationDAOImpl with qualifiers [@Any @Default]; local interfaces are [ConfigurationDAO]
-		# ^^^ hier fehlt das schliessende ]
-		if [logClassName] == "stdout" {
-			if [message] =~ /^[\w ]+ \[.*?\]? with qualifiers \[.*?\].*/ {
-				mutate { add_tag => ["WELD-bean-info"] }
-			}
-
-			mutate { add_tag => ["EbeguInternal", "Ignore"] }
-		}
-		if [logClassName] == "ch.dvbern.ebegu.services.RulesServiceBean" {
-			if [message] == "Mandant wird noch nicht beruecksichtigt. Codeaenderung noetig" {
-				mutate {
-					add_tag => ["Ignore", "Mandant"]
-				}
-			}
-		}
-		if [logClassName] == "ch.dvbern.ebegu.services.MailServiceBean" {
-			if "Email fuer" in [message] {
-				mutate {add_tag = > ["Ignore", "Mailing"] }
-			}
-		}
-	}
-}
+  # Mandant wird noch nicht beruecksichtigt. Codeaenderung noetig -> Ignore, Mandant
+  grok {
+    match => [ "message", ".*Mandant wird noch nicht beruecksichtigt. Codeaenderung noetig.*" ]
+    add_tag => [ "Ignore", "Mandant"]
+    tag_on_failure => []
+  }
+  # RelayState Param '' seems to be invalid, ignoring -> Ignore
+  grok {
+    match => [ "message", ".*RelayState Param '' seems to be invalid, ignoring.*" ]
+    add_tag => [ "Ignore"]
+    tag_on_failure => []
+  }
+  # EBEGU SAML Servlet failed to process SSO Response -> Ignore
+  grok {
+    match => [ "message", ".*EBEGU SAML Servlet failed to process SSO Response.*" ]
+    add_tag => [ "Ignore"]
+    tag_on_failure => []
+  }
+  # does not point to a valid jar for a Class-Path reference -> Ignore
+  grok {
+    match => [ "message", ".*does not point to a valid jar for a Class-Path reference.*" ]
+    add_tag => [ "Ignore"]
+    tag_on_failure => []
+  }
+  # Achtung, es wurde versucht, ein Dokument mit WriteProtection neu zu erstellen -> DocumentGeneration
+  grok {
+    match => [ "message", ".*Achtung, es wurde versucht, ein Dokument mit WriteProtection neu zu erstellen -> DocumentGeneration.*" ]
+    add_tag => [ "DocumentGeneration"]
+    tag_on_failure => []
+  }
+  # EbeguValidationExceptionMapper, EbeguConstraintValidationExceptionMapper -> EbeguValidations
+  grok {
+    match => [ "logClassName", "EbeguValidationExceptionMapper" ]
+    add_tag => [ "EbeguValidations"]
+    tag_on_failure => []
+  }
+  grok {
+    match => [ "logClassName", "EbeguConstraintValidationExceptionMapper" ]
+    add_tag => [ "EbeguValidations"]
+    tag_on_failure => []
+  }
+  # EJBAccessException, is not allowed -> EbeguBerechtigungen
+  grok {
+    match => [ "message", ".*EJBAccessException.*" ]
+    add_tag => [ "EbeguBerechtigungen"]
+    tag_on_failure => []
+  }
+  grok {
+    match => [ "message", ".*is not allowed.*" ]
+    add_tag => [ "EbeguBerechtigungen"]
+    tag_on_failure => []
+  }
+  # Batch update returned unexpected row count from update -> OptimisticLockException
+  grok {
+    match => [ "message", ".*is not allowed.*" ]
+    add_tag => [ "OptimisticLockException"]
+    tag_on_failure => []
+  }
+  # ch.dvbern.ebegu.dto.personensuche.EWKResultat, PersonenSucheService WSDL -> EWK
+  grok {
+    match => [ "message", ".*ch.dvbern.ebegu.dto.personensuche.EWKResultat.*" ]
+    add_tag => [ "EWK"]
+    tag_on_failure => []
+  }
+  grok {
+    match => [ "message", ".*PersonenSucheService WSDL.*" ]
+    add_tag => [ "EWK"]
+    tag_on_failure => []
+  }
+}