start rules for TlsStream logs

helps with #13

filter-50-pluginchecktask.conf

@@ -7,7 +7,7 @@ filter {
         add_tag => "icinga_checkcommandforobject"
         tag_on_failure => ["_grokparsefailure","icinga_checkcommandforobject_failed"]
         add_field => {
-          "[icinga][eventtype]" => "icinga_checkcommandforobject"
+          "[icinga][eventtype]" => "checkcommandforobject"
         }
       }
     }

filter-50-tlsstream.conf

@@ -0,0 +1,24 @@
+filter {
+  if [icinga][facility] == "TlsStream" {
+    if [message] =~ /^OpenSSL error:/ {
+      grok {
+        match => ["message","OpenSSL error: error:%{DATA:[icinga][sslerrorcode]}:%{GREEDYDATA:[icinga][sslerrordetails]}"]
+        id => "icinga_opensslerror"
+        add_tag => "icinga_opensslerror"
+        tag_on_failure => ["_grokparsefailure","icinga_opensslerror_failed"]
+        add_field => {
+          "[icinga][eventtype]" => "opensslerror"
+        }
+      }
+    } else if [message] == "TLS stream was disconnected." {
+      mutate {
+        id => "icinga_tlsstreamdisconnected"
+        add_tag => "icinga_tlsstreamdisconnected"
+        add_field => {
+          "[icinga][eventtype]" => "tlsstreamdisconnected"
+        }
+      }
+    }
+  }
+}
+