FEATURE: grok-pattern-files configurable over pillars

logstash/files/pattern.jinja2

@@ -0,0 +1,7 @@
+############################# 
+#      MANAGED BY SALT      #
+# !! DON'T EDIT MANUALLY !! #
+#############################
+{%- for pattern in (patterns|load_json) %}
+{{ pattern }}
+{%- endfor %}

logstash/init.sls

@@ -48,12 +48,34 @@ logstash-config-filters:
     - template: jinja
     - require:
       - pkg: logstash-pkg
+
 {%- else %}
 logstash-config-filters:
   file.absent:
     - name: /etc/logstash/conf.d/02-filters.conf
 {%- endif %}
 
+{%- if logstash.patterns is defined %}
+{%- for name, patterns in logstash.patterns.items() %}
+logstash-pattern-{{name}}:
+  file.managed:
+    - name: /etc/logstash/patterns/{{name}}
+    - template: jinja
+    - source: salt://logstash/files/pattern.jinja2
+    - context:
+        patterns: '{{patterns|json}}'
+    - makedirs: True
+    - require:
+      - pkg: logstash-pkg
+    - watch_in:
+      - service: logstash-svc
+{%- endfor %}
+{%- else %}
+logstash-patterns:
+  file.absent:
+    - name: /etc/logstash/patterns
+{%- endif %}
+
 {%- if logstash.outputs is defined %}
 logstash-config-outputs:
   file.managed:

pillar.example

@@ -36,4 +36,16 @@ logstash:
       hosts:
         - logs.example.com
       port: 5000
-      ssl_certificate: /etc/ssl/certs/lumberjack.crt
+      ssl_certificate: /etc/ssl/certs/lumberjack.crt
+
+  # custom grok-pattern-files going to /etc/logstash/pattern
+  patterns:
+    # filename will be "syslog"
+    syslog:
+      # one entry per line in file
+      - 'SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:message}'
+    salt:
+      - 'SALTLOG_LEVEL (?:DEBUG|FATAL|ERROR|WARNING|INFO)'
+      - 'SALTCMD @?[a-z]\w+(?:\.@?[a-z]\w+)*'
+      - 'SALTLOGBASE %{TIMESTAMP_ISO8601:timestamp} \[%{SALTCMD:saltcmd}(?:([ \t]+)?)\]\[%{SALTLOG_LEVEL:priority}(?:[ \t]+)\] %{GREEDYDATA:message}'
+