filebeat multiline配置(转)

使用filebeat5.0.1版本,用filebeat作为日志收集工具时:
java日志格式需要多行匹配,在filebeat配置文件中添加:
### Multiline options
# Mutiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
multiline.pattern: ^[
# Defines if the pattern set under pattern should be negated or not. Default is false.
multiline.negate: true
# Match can be set to “after” or “before”. It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
multiline.match: after

上面配置的意思是:不以[开头的行都合并到上一行的末尾

pattern:正则表达式

negate:true 或 false;默认是false,匹配pattern的行合并到上一行;true,不匹配pattern的行合并到上一行

match:after 或 before,合并到上一行的末尾或开头

filebeat.prospectors:

  • input_type: log

    paths:

    • /home/work/workspace/ws/risk_rebuild/log/*.log

    multiline:
    pattern: ‘^\d{4}-\d{2}-\d{2}’
    negate: true
    match: after
    max_lines: 20
    timeout: 5s
    tail_files: false

output.elasticsearch:
# Array of hosts to connect to.
hosts: [“172.16.102.102:9200”,”172.16.102.103:9200”,”172.16.102.104:9200”]
index: “risk_engine

  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值