logstash合并有换行符的日志

最新推荐文章于 2023-08-10 09:44:59 发布

nanjizhiyin

最新推荐文章于 2023-08-10 09:44:59 发布

阅读量4.1k

点赞数 1

本文链接：https://blog.csdn.net/nanjizhiyin/article/details/80692339

版权

出现error日志时,有时出现多行信息,如果不处理,logstash会当成多条日志看待.如果你的日志是以时间开关的,请添加如下配置
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
what => "previous"
negate => true
}

    file {                                                                                                                                                                                                          
        path => "/data/securityopdata/syncapi/logs/*.log"                                                                                                                                                           
        type => "logfile"                                                                                                                                                                                           
        start_position => "beginning"                                                                                                                                                                               
        #sincedb_path => "/dev/null"                                                                                                                                                                                
        codec => multiline {                                                                                                                                                                                        
            pattern => "^%{TIMESTAMP_ISO8601}"                                                                                                                                                                      
            what => "previous"                                                                                                                                                                                      
            negate => true                                                                                                                                                                                          
        }                                                                                                                                                                                                           
        add_field => {                                                                                                                                                                                              
            HOSTNAME => "郜金丹的空间"                                                                                                                                                                              
            project_name => "syncapi"                                                                                                                                                                               
        }                                                                                                                                                                                                           
    }