logstash合并有换行符的日志

出现error日志时,有时出现多行信息,如果不处理,logstash会当成多条日志看待.如果你的日志是以时间开关的,请添加如下配置
codec => multiline { 
pattern => "^%{TIMESTAMP_ISO8601}" 
what => "previous" 
negate => true 
}

    file {                                                                                                                                                                                                          
        path => "/data/securityopdata/syncapi/logs/*.log"                                                                                                                                                           
        type => "logfile"                                                                                                                                                                                           
        start_position => "beginning"                                                                                                                                                                               
        #sincedb_path => "/dev/null"                                                                                                                                                                                
        codec => multiline {                                                                                                                                                                                        
            pattern => "^%{TIMESTAMP_ISO8601}"                                                                                                                                                                      
            what => "previous"                                                                                                                                                                                      
            negate => true                                                                                                                                                                                          
        }                                                                                                                                                                                                           
        add_field => {                                                                                                                                                                                              
            HOSTNAME => "郜金丹的空间"                                                                                                                                                                              
            project_name => "syncapi"                                                                                                                                                                               
        }                                                                                                                                                                                                           
    } 

阅读更多
想对作者说点什么? 我来说一句

没有更多推荐了,返回首页

加入CSDN,享受更精准的内容推荐,与500万程序员共同成长!
关闭
关闭