云计算企业级小架构部署应用综合练习（五）- Logstash 处理多种日志并分别创建不同的索引

最新推荐文章于 2022-08-01 17:53:55 发布

shark_西瓜甜

最新推荐文章于 2022-08-01 17:53:55 发布

阅读量319

点赞数

分类专栏：自动化运维云计算综合项目

本文链接：https://blog.csdn.net/qq_22648091/article/details/114305427

版权

自动化运维同时被 2 个专栏收录

16 篇文章 0 订阅

订阅专栏

云计算综合项目

7 篇文章 7 订阅

订阅专栏

一、架构图图

在这里插入图片描述

配置

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  # 监听 5044 端口，用于接收 filebeat 输出的日志数据
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    if [event][dataset] == "nginx.access" {
	    elasticsearch {
	      hosts => ["es01:9200","es02:9200","es03:9200"]
	      manage_template => false
	      index => "%{[host][hostname]}-nginx-access-%{+YYYY.MM.dd}"
	      pipeline => "%{[@metadata][pipeline]}"
	    }

    }else if [event][dataset] == "nginx.error"  {
	    elasticsearch {
	      hosts => ["es01:9200","es02:9200","es03:9200"]
	      manage_template => false
	      index => "%{[host][hostname]}-nginx-error-%{+YYYY.MM.dd}"
	      pipeline => "%{[@metadata][pipeline]}"
	    }
    }else if [event][dataset] == "mysql.error" {
	    elasticsearch {
	      hosts => ["es01:9200","es02:9200","es03:9200"]
	      manage_template => false
	      index => "%{[host][hostname]}-mysql-error-%{+YYYY.MM.dd}"
	      pipeline => "%{[@metadata][pipeline]}"
	    }
    }else if [event][dataset] ==  "mysql.slowlog" {
	    elasticsearch {
	      hosts => ["es01:9200","es02:9200","es03:9200"]
	      manage_template => false
	      index => "%{[host][hostname]}-mysql-slowlog-%{+YYYY.MM.dd}"
	      pipeline => "%{[@metadata][pipeline]}"
	    }
    }
  } else {
    elasticsearch {
      hosts => ["es01:9200","es02:9200","es03:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  }
}