filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => <%= @logstash_filter_pattern_params['syslog_filter_match'] %>
    }
  }
}

filter {
  if [type] == "syslog" {
    # Do not log passwords when they came from puppet-agent. Be case insensitive
    # about it.
    # Watch for mysql "access denied for user " logs, as these do not contain
    # passwords - could be logged.
    if [message] =~ "(?i)puppet-agent"
     and [message] =~ "(?i)password"
     and [message] !~ "(?i)1045, \"Access denied for user" {
      drop {}
    }
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => <%= @logstash_filter_pattern_params['syslog_filter_match'] %>
    }
  }
}

Update syslog filter in logstash
Update syslog filter in logstash

By filtering the messages in syslog part we might
not storage these messages which have password in it.
Look for puppet-agent, password string within string message
and be case insensitive about it.

Change-Id: I09b750d4126eda075922957e8c338c6ac2a385b6
