NAM Analytics Server additional events

Hi.


I would really need some tips/advices/helps with additional event collection into NAM Analytics server.
I would like collecting URL statistic for services on Access Manager. This is event https://www.netiq.com/documentation/access-manager-45/admin/data/bb21s4e.html which I would like to get from NAG to NAM Analytics.
So far I have created new event file in /opt/novell/nam/logstash/config/conf.d/events/01-05-002E0512.conf:
filter {


if [I]=="002E0512"
     {   
          mutate
          {
            split => ["T", "?"]
           
            rename => { "I" => "eventID" }


            add_field => { "sid" => "%{[T][0]}" }
            add_field => { "[appdata][accessType]" => "ag_url" }
            add_field => { "[appdata][appName]" => "%{F}" }
            add_field => { "[appdata][eventTime]" => "%{timestamp}" }
            add_field => { "[appdata][appURL]" => "%{Y}" }
           
            remove_field => [ "A","D","type","F","G","H","L","V","logsource","1","2","3","O","o","patch","os","priority",
                              "severity_label","facility_label","build","facility","severity","S","T","M","timestamp",
                              "os_name","message","U","host","Y","@version","device","B","minor","major" ]
          }
       


     }
  }


and
add configuration in the  /opt/novell/nam/logstash/config/conf.d/events/02-01-output.conf:
else if[eventID]=="002E0514" or [eventID]=="002E0102" or [eventID]== "002E0029" or [eventID]== "002E0512"
        {
     if[sid]!="null"
     {
            elasticsearch
            {
               hosts => ["localhost:9200"]
               document_id => "%{sid}"
               index =>  "dashboard_write"
and
add configuration in the /opt/novell/nam/logstash/config/conf.d/events/01-01-drop_other_events.conf:
filter {
if "002E000A" not in [message] and "002E0525" not in [message] and "002E0514" not in [message] and "002E0102" not in [message] and "002E0047" not in [message]
     and "002E0027" not in [message] and "002E000C" not in [message] and "002E0606" not in [message] and "002E001F" not in [message] and "002E0029" not in [message]
 and "002E00512" not in [message]
  {
     drop { }
  }
  }


and enable event "URL Accessed" adminconsole on AG but still can't see any event ID 0x002e0512 in the Discover tab on Analytics server.
Can anyone help me with this?
Thanks.
Gregor

Click to add a signature