版本7.10.2 Elastic Search + Logstash + Kibana 搭建简易审计系统数据源

1. 修改logstash配置文件

# 内容
input {
  file {
    path => "/Users/zfh/IdeaProjects/xxSystem/med/log/apps/xx.log"  # 日志路径
    type => "log"    # 类型
    start_position => "beginning"   # 从何处开始
    stat_interval => "2"    #监听间隔时间
  }
}

filter {
  # IDEA日志格式  2022-11-02T11:48:40.863+0800 [INFO] xxSystem/xxServer c.g.g.e.c.i.xxUtils http-nio-8091-exec-2
  #定义数据的格式
  grok {
    match => { "message" => "%{NOTSPACE:timestamp} %{NOTSPACE:level} %{NOTSPACE:projectName} %{NOTSPACE:className} %{NOTSPACE:detailMessage}"}
  }
}

output {
  elasticsearch {
    hosts => ["localhost:9200"]   # 修改
    index => "logstash-systemlog-%{+YYYY.MM.dd}"  # 命名索引为logstash-systemlog-年-月-日
  }
}

2. grok表达式含义

USERNAME [a-zA-Z0-9._-]+
USER %{USERNAME}
INT (?:[+-]?(?:[0-9]+))
BASE10NUM (?<