What is really strange is the Better Apache Dashboard is just a modified version of the Apache Dashboard. I exported the Apache Dashboard and did a compare of it with the Better Apache Dashboard and the Bandwidth and Events panels are exactly the same. Does not make much since that those panels show up properly in Apache Dashboard and not in Better Apache Dashboard. ???
if [type] == 'apache_access' {
grok {
match => ['message', '%{SYSLOGBASE}']
match => [ 'message', '%{COMBINEDAPACHELOG}']
}
date {
match => [ 'timestamp', 'dd/MMM/yyyy:HH:mm:ss Z' ]
}
mutate {
replace => [ 'type', 'apache_access' ]
convert => [ 'bytes', 'integer' ]
convert => [ 'response', 'integer' ]
}
}
I think the Better Apache Dashboard might be getting cached somewhere. You could try importing it and saving it under a new name and see if that reproduces the panels? It's a bit old, but it loads into my NLS 1.4.4 just fine.
Well that did give me the logsource, but now not getting the other items like verb, response, request, bytes.... Looks like it might be skipping the COMBINEDAPACHELOG match.
Found simular problem listed in logstash issues, but it was indicated that the format you gave me was fixed in logstash 1.5.0, but that seems to not be the case. The format I put in seems to now have all the info. Monitoring now.
Last time I imported Better Apache Dashboard, I did change the name and still no go. LOL of course it would work for you, isn't that the case most of the time.. It works for support...
I have one other question, kinda related, now that I have it working, I have created a dashboard which some of the maps and graphs, is there a way to display that without a login? We have a "kiosk" setup for displaying status info and would like to display some local dashboards.
IE!!!... LOL