有时我们需要根据不同的日志文件创建不同的索引,下面提供一份现网环境在用的filebeat配置,提供不同文件上传不同索引,并且能够根据日志格式自动解析字段。
name: "XXXXXXXXXXX"
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
filebeat.inputs:
- type: log
enabled: true
paths:
- /*.log
processors:
- dissect:
tokenizer: "%{logTime} [%{thread}] %{message}"
field: "message"
- type: log
enabled: true
paths:
- /*.log
processors:
- decode_json_fields:
fields: ["message"]
target: ""
setup.kibana:
host: "127.0.0.1:9000"
output.elasticsearch:
hosts: "${ELASTICSEARCH_HOSTS:127.0.0.1:9200}"
indices:
- index: "XXXXXX-%{+yyyy.MM.dd}"
when.contains:
tags: "XXXXXX"
- index: "XXXXXX-%{+yyyy.MM.dd}"
when.contains:
tags: "XXXXXXXXXX"