filter-50-configobjectutility.conf

filter {
  if [icinga][facility] == "ConfigObjectUtility" {
    if [message] =~ /^Created and activated object/ {
      grok {
        match => ["message","Created and activated object 'rb-hyc_stin_s-url-checkpoint_int_sl3_eu!l_hyc_stin_f5_ext_check_s_ciosa3!e19908e2-8aca-4e63-bc87-b8a0f6cbe31c' of type 'Comment'."]
        id => "createobject"
        add_tag => "icinga_createobject"
        tag_on_failure => ["_grokparsefailure","icinga_createobject_failed"]
      }
    }
  }
}