zoukankan      html  css  js  c++  java
  • ELK IIS 日志-->logstash-->ElasticSearch

    NXLOG 配置

       

    #define ROOT C:Program Files xlog

    define ROOT C:Program Files (x86) xlog

       

    Moduledir %ROOT%modules

    CacheDir %ROOT%data

    Pidfile %ROOT%data xlog.pid

    SpoolDir %ROOT%data

    LogFile %ROOT%data xlog.log

       

       

    <Extension w3c>

    Module xm_csv

    Fields $date, $time, $s-ip, $cs-method, $cs-uri-stem, $cs-uri-query, $s-port, $cs-username, $c-ip, $csUser-Agent, $sc-status, $sc-substatus, $sc-win32-status, $time-taken

    FieldTypes string, string, string, string, string, string, integer, string, string, string, integer, integer, integer, integer

    Delimiter ' '

    </Extension>

       

    <Extension json>

    Module xm_json

    </Extension>

       

    <Extension syslog>

    Module xm_syslog

    </Extension>

       

       

    <Input IIS_Logs>

    Module im_file

    File "C:inetpublogsLogFilesW3SVC18u_ex*.log"

    SavePos TRUE

    Exec if $raw_event =~ /^#/ drop();                                 

    else                                                         

    {                                                         

    w3c->parse_csv();                                         

    $EventTime = parsedate($date + "T" + $time+"Z");         

    $SourceName = "IIS";                                        

    }

    </Input>

       

    <Output IIS_out>

    Module om_tcp

    Host 127.0.0.1

    Port 5545

    Exec to_json();

    </Output>

       

    <Route 2>

    Path IIS_Logs => IIS_out

    </Route>

       

    Logstash 配置

       

    input {

    tcp {

    port=>5545

    type=>"iis-input"

    codec => "json"

    }

    }

       

    output {

    if [type]=="iis-input" {

    elasticsearch {

    hosts => ["localhost:9200"]

    index=>"logstash-%{type}-%{+YYYY.MM.dd}"

    document_type=>"%{type}"

    }

    }

    }

       

       

       

       

  • 相关阅读:
    服务器IIS禁止通过IP访问
    如何自定义Kubernetes资源
    敏捷 | 无处不在的敏捷思想应用
    敏捷 | 如何做好服务型Scrum Master?
    敏捷 | 如何填好推进的坑?
    敏捷 | 如何正确推进敏捷?
    敏捷 | 如何正确理解敏捷?
    管理 |《技术管理案例课》学习总结(下)
    管理 |《技术管理案例课》学习总结(上)
    《ArcGIS 从基础到实战》书正式出版
  • 原文地址:https://www.cnblogs.com/liuyuhua/p/5329203.html
Copyright © 2011-2022 走看看