# Needed for Graylogfields_under_root: truefields.collector_node_id: ${sidecar.nodeName}fields.gl2_source_collector: ${sidecar.nodeId}filebeat.inputs:- input_type: logpaths:- /data/3306/slow.logtype: logmultiline.pattern: '^\# Time: [0-9]{4}-[0-9]{2}-[0-9]{2}'multiline.negate: truemultiline.match: afteroutput.logstash:hosts: ["172.16.145.65:5044"]path:data: /var/lib/graylog-sidecar/collectors/filebeat/datalogs: /var/lib/graylog-sidecar/collectors/filebeat/log(?m)^# Time:.*\s+# User@Host: %{USER:user}\[[^\]]+\] @ (?:(?<clienthost>\S*) )?\[(?:%{IP:clientip})?\]\s*Id: %{NUMBER:id}\s+# Query_time: %{NUMBER:query_time}\s+Lock_time: %{NUMBER:lock_time}\s+Rows_sent: %{NUMBER:rows_sent}\s+Rows_examined: %{NUMBER:rows_examined}\s*(?:use %{DATA:database};\s*)?SET timestamp=%{NUMBER:timestamp};\s*(?<query>(?<action>\w+)\s+.*)$