Finalized Error-Handling for Logstash processing

Author: Chris Wiechmann

logstash/config/traffic_details_index_template.json

@@ -1,6 +1,7 @@
 {
     "index_patterns": [
-        "apigw-traffic-details-*"
+        "apigw-traffic-details-*",
+        "apigw-traffic-errors-*"
     ],
     "settings": {
         "number_of_shards": 5, 

logstash/pipeline/pipeline.conf

@@ -80,13 +80,17 @@ filter {
           clone {
             clones => ['errorEvent']
           }
-          # Fill the URI based on the given path to have it shown in Traffic-Monitor
-          mutate { add_field => { "[transactionElements][leg0][protocolInfo][http][uri]" => "%{[transactionSummary][path]}" } }
-          mutate { replace => { "[transactionElements][leg0][protocolInfo][http][status]" => "XXX" } }
-          mutate { replace => { "[transactionElements][leg0][protocolInfo][http][statusText]" => "ERROR" } }
-          mutate { replace => { "[transactionElements][leg0][protocolInfo][http][authSubjectId]" => "ID: %{[correlationId]}" } }
-          mutate { replace => { "[transactionSummary][serviceContext][vhost]" => "Logstash Error" } }
-          mutate { replace => { "[transactionSummary][serviceContext][method]" => "check the logs" } }
+          if [type] == 'errorEvent' {
+            # Fill the URI based on the given path to have it shown in Traffic-Monitor
+            mutate { add_field => { "[correlationId]" => "-Error" } }
+            mutate { add_field => { "[transactionElements][leg0][protocolInfo][http][uri]" => "%{[transactionSummary][path]}" } }
+            mutate { replace => { "[transactionElements][leg0][protocolInfo][http][vhost]" => "Logstash Error" } }
+            mutate { replace => { "[transactionElements][leg0][protocolInfo][http][method]" => "LOGSTASH" } }
+            mutate { replace => { "[transactionElements][leg0][protocolInfo][http][status]" => "900" } }
+            mutate { replace => { "[transactionElements][leg0][protocolInfo][http][statusText]" => "ERROR" } }
+            mutate { replace => { "[transactionElements][leg0][protocolInfo][http][authSubjectId]" => "ID: %{[correlationId]}" } }
+            mutate { replace => { "[transactionSummary][serviceContext][method]" => "check the logs" } }
+          }
         }
       }
       #}

logstash/test/test-openlog-events.json

@@ -138,7 +138,7 @@
           },
           {
             "@timestamp": "2020-07-13T20:07:27.467Z",
-            "correlationId": "OMG-UNKNOWN-API",
+            "correlationId": "OMG-UNKNOWN-API-Error",
             "logtype": "openlog",
             "processInfo": {
               "hostname": "ip-172-31-62-146.ec2.internal",