语法格式
logstash中行为事件,流程:事件---input---codec---filter---codec----output
input{ #注释 stdin{ } } #可以不用写 filter{ } output{ elasticsearch{ hosts => ["ip:9200"] index = "test-%{+YYYY.DD.mm}" } stdout{ codec => "rubydebug" } }
rsyslog日志收集
input{ file{ path => ["/var/log/messages","/var/log/secure"] type => "system-log" start_postition => "beginning" } } filter{ } output{ elasticsearch{ hosts => ["ip:9200"] index => "system-log-%{+YYYY.MM}" } }
es 日志收集
input{ file{ path => ["/var/log/messages","/var/log/secure"] type => "system-log" start_postition => "beginning" file{ path => "/var/log/elasticsearch/es.log" type => "es-log" start_postition => "beginning" codec => multiline{ pattern =>"^\[" negate => true what => "prevIoUs" } syslog{ type => "system-syslog" port => 514 } } } } filter{ } output{ if [type]=="system-log"{ elasticsearch{ hosts => ["ip:9200"] index => "system-log-%{+YYYY.MM}" } } if [type]=="es-log"{ elasticsearch{ hosts => ["ip:9200"] index => "system-log-%{+YYYY.MM}" } } if [type]=="system-syslog"{ elasticsearch{ hosts => ["ip:9200"] index => "system-syslog-%{+YYYY.MM}" } } stdout{ codec => "rubydebug" } }
tcp 日志收集
input{ tcp{ type => "tcp" port => "6666" mode => "server" } } output{ stdout{ codec => rubydebug } }
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。