zoukankan      html  css  js  c++  java
  • filebeat+logstash配置

    一. filebeat.yml的配置

    filebeat.prospectors:
    - input_type: log
    paths:
    - /tmp/logs/optimus-activity-api.log
    document_type: "czh-uat-activity"
    multiline:
    pattern: '^s*("{)'
    negate: true
    match: after
    max_lines: 1000
    timeout: 30s
    fields:
    logsource: uat
    logtype: czh-uat-activity


    - input_type: log
    paths:
    - /tmp/logs/optimus-coupon-api.log
    document_type: "czh-uat-coupon"
    fields:
    logsource: uat139.224.146.96
    logtype: czh-uat-coupon


    - input_type: log
    paths:
    - /tmp/logs/optimus-bean-api.log
    document_type: "czh-uat-bean"
    fields:
    logsource: uat
    logtype: czh-uat-bean


    - input_type: log
    paths:
    - /tmp/logs/optimus-external-api.log
    document_type: "czh-uat-external-web"
    fields:
    logsource: uat
    logtype: czh-uat-external-web

    - input_type: log
    paths:
    - /tmp/logs/api-gateway-production.log
    document_type: "czh-uat-gateway"
    fields:
    logsource: uat
    logtype: czh-uat-gateway

    - input_type: log
    paths:
    - /tmp/logs/optimus-manage-api.log
    document_type: "czh-uat-manage"
    fields:
    logsource: uat
    logtype: czh-uat-manage

    - input_type: log
    paths:
    - /tmp/logs/optimus-order-api.log
    document_type: "czh-uat-api-order"
    fields:
    logsource: uat
    logtype: czh-uat-api-order

    - input_type: log
    paths:
    - /tmp/logs/optimus-parent-plus-api.log
    document_type: "czh-uat-parent-plus"
    fields:
    logsource: uat
    logtype: czh-uat-parent-plus

    - input_type: log
    paths:
    - /tmp/logs/optimus-user-api.log
    document_type: "czh-uat-user-production"
    fields:
    logsource: uat
    logtype: czh-uat-user-production

    将采集的日志导入logstash里
    output.logstash:
    hosts: ["192.168.102.38:5044"]

    二. logstash的配置:

    1.------input配置--------

    input {
    beats {
    port => 5044
    }

    }

    if [fields][logtype] == "czh-uat-activity" {
    json {
    source => "message"
    target => "data"
    }
    }


    if [fields][logtype] == "czh-uat-coupon" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-bean" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-external-web" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-gateway" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-manage" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-api-order" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-parent-plus" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-user-production" {
    json {
    source => "message"
    target => "data"
    }
    }

    -------output-配置------

    if [fields][logtype] == "czh-uat-activity"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]   #将处理后的日志存储到 elasticsearch,多个IP是因为做了集群
    index => "czh-uat-activity"   #创建索引
    }
    }

    if [fields][logtype] == "czh-uat-coupon"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-coupon"
    }
    }

    if [fields][logtype] == "czh-uat-bean"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-bean"
    }
    }

    if [fields][logtype] == "czh-uat-external-web"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-external-web"
    }
    }

    if [fields][logtype] == "czh-uat-gateway"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-gateway"
    }
    }

    if [fields][logtype] == "czh-uat-manage"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-manage"
    }
    }

    if [fields][logtype] == "czh-uat-api-order"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-api-order"
    }
    }

    if [fields][logtype] == "czh-uat-parent-plus"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-parent-plus"
    }
    }

    if [fields][logtype] == "czh-uat-user-production"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-user-production"
    }
    }

  • 相关阅读:
    记: Spring Data Jpa @OneToMany 级联查询被动触发的问题
    后端小白的Bootstrap笔记
    最短路径问题
    深度优先搜索 & 广度优先搜索
    检讨书板子
    关于计时器
    博客园美化
    P4819 杀人游戏 (图论 )
    水站 (二分)
    对拍
  • 原文地址:https://www.cnblogs.com/lhlucky/p/elk-filebeat-logstash.html
Copyright © 2011-2022 走看看