filebeat是什么?可以百度下,以下就不详细说明了。本文章主要记录解析json日志步骤。
大概分三步:
a.统一定义json日志格式和保存文件类型及路径
b.用filebeat采集日志路径,编写采集脚本
c.写入elasticsearch,并进行过滤为空日志记录不入库
以下是输出详细脚本:
filebeat.inputs:
- type: log
enabled: true
paths:
- E:/20210223/*.log
setup.template.enabled: false
setup.ilm.enabled: false
processors:
- dissect:
tokenizer: "===%{} %{} %{} %{} %{} - out:%{msg1}"
field: "message"
target_prefix: "dissect"
- decode_json_fields:
fields: ["dissect.msg1"]
max_depth: 1
target: ""
overwrite_keys: true
- drop_fields:
fields: ["ecs","agent","log","message", "dissect"]
output.elasticsearch:
hosts: ["localhost:9200"]
indices:
- index: "logs_json"
when.has_fields: ['log_type']
bulk_max_size: 1000
简单记录下,努力加油!!!