logstash 实现数据源分流

logstash + filebeat 将来源不同的数据分发到不同的地方

logstash配置文件：first-pipeline.conf

input {
  beats {
    port => 5044
  }
}
filter {
    if "backend" in  [tag] {   # 如果tags等于backend，就进行数据切割
    grok {
                match => ["message", "%{TIMESTAMP_ISO8601:datetime}"]
        }
    mutate {
        split => ["message","|"]
    }
    mutate {
              add_field => {
              "userID" => "%{[message][3]}"
              "level" => "%{[message][2]}"
              "log_path" => "%{[message][1]}"
              "function" => "%{[message][4]}"
              "dev_message" => "%{[message][5]}"
               }
        }
    mutate {
        join => ["message", "|"]
    }
    }
}
output {
    if "nginx" in [tags]    # 如果tags是nginx，就输出到终端
    {
    stdout { codec => rubydebug }   # 输出到终端调试使用
    }
}

filebeat收集配置文件

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/*.log
  tags: ["nginx"]   # logstash根据tags的值，进行判断数据来源于哪里

output.logstash:
        hosts: ["127.0.0.1:5044"]