zoukankan      html  css  js  c++  java
  • filebeat+logstash配置

    一. filebeat.yml的配置

    filebeat.prospectors:
    - input_type: log
    paths:
    - /tmp/logs/optimus-activity-api.log
    document_type: "czh-uat-activity"
    multiline:
    pattern: '^s*("{)'
    negate: true
    match: after
    max_lines: 1000
    timeout: 30s
    fields:
    logsource: uat
    logtype: czh-uat-activity


    - input_type: log
    paths:
    - /tmp/logs/optimus-coupon-api.log
    document_type: "czh-uat-coupon"
    fields:
    logsource: uat139.224.146.96
    logtype: czh-uat-coupon


    - input_type: log
    paths:
    - /tmp/logs/optimus-bean-api.log
    document_type: "czh-uat-bean"
    fields:
    logsource: uat
    logtype: czh-uat-bean


    - input_type: log
    paths:
    - /tmp/logs/optimus-external-api.log
    document_type: "czh-uat-external-web"
    fields:
    logsource: uat
    logtype: czh-uat-external-web

    - input_type: log
    paths:
    - /tmp/logs/api-gateway-production.log
    document_type: "czh-uat-gateway"
    fields:
    logsource: uat
    logtype: czh-uat-gateway

    - input_type: log
    paths:
    - /tmp/logs/optimus-manage-api.log
    document_type: "czh-uat-manage"
    fields:
    logsource: uat
    logtype: czh-uat-manage

    - input_type: log
    paths:
    - /tmp/logs/optimus-order-api.log
    document_type: "czh-uat-api-order"
    fields:
    logsource: uat
    logtype: czh-uat-api-order

    - input_type: log
    paths:
    - /tmp/logs/optimus-parent-plus-api.log
    document_type: "czh-uat-parent-plus"
    fields:
    logsource: uat
    logtype: czh-uat-parent-plus

    - input_type: log
    paths:
    - /tmp/logs/optimus-user-api.log
    document_type: "czh-uat-user-production"
    fields:
    logsource: uat
    logtype: czh-uat-user-production

    将采集的日志导入logstash里
    output.logstash:
    hosts: ["192.168.102.38:5044"]

    二. logstash的配置:

    1.------input配置--------

    input {
    beats {
    port => 5044
    }

    }

    if [fields][logtype] == "czh-uat-activity" {
    json {
    source => "message"
    target => "data"
    }
    }


    if [fields][logtype] == "czh-uat-coupon" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-bean" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-external-web" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-gateway" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-manage" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-api-order" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-parent-plus" {
    json {
    source => "message"
    target => "data"
    }
    }

    if [fields][logtype] == "czh-uat-user-production" {
    json {
    source => "message"
    target => "data"
    }
    }

    -------output-配置------

    if [fields][logtype] == "czh-uat-activity"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]   #将处理后的日志存储到 elasticsearch,多个IP是因为做了集群
    index => "czh-uat-activity"   #创建索引
    }
    }

    if [fields][logtype] == "czh-uat-coupon"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-coupon"
    }
    }

    if [fields][logtype] == "czh-uat-bean"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-bean"
    }
    }

    if [fields][logtype] == "czh-uat-external-web"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-external-web"
    }
    }

    if [fields][logtype] == "czh-uat-gateway"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-gateway"
    }
    }

    if [fields][logtype] == "czh-uat-manage"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-manage"
    }
    }

    if [fields][logtype] == "czh-uat-api-order"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-api-order"
    }
    }

    if [fields][logtype] == "czh-uat-parent-plus"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-parent-plus"
    }
    }

    if [fields][logtype] == "czh-uat-user-production"{
    elasticsearch {
    hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
    index => "czh-uat-user-production"
    }
    }

  • 相关阅读:
    JavaScript中的this指向
    JQ延迟对象
    JavaScript事件简述
    1.0 HTML/CSS 优化--《高效前端》学习笔记
    浏览器工作原理(学习笔记)
    this 绑定例外之间接引用
    全局函数是否存在闭包?
    nuxt + vue-i18n 踩坑记录
    继承(学习笔记) —— 《高级教程》
    三、函数作用域和块作用域(学习笔记)—— 《你不知道的JavaScript》
  • 原文地址:https://www.cnblogs.com/lhlucky/p/elk-filebeat-logstash.html
Copyright © 2011-2022 走看看