我的日志格式如下:(以 |- 开头)
|- 2020-07-11 13:05:59 ERROR [restartedMain] org.apache.catalina.core.StandardService : 182 Failed to start connector [Connector[HTTP/1.1-8080]]
org.apache.catalina.LifecycleException: Failed to start component [Connector[HTTP/1.1-8080]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
at org.apache.catalina.core.StandardService.addConnector(StandardService.java:225)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.addPreviouslyRemovedConnectors(TomcatWebServer.java:256)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:198)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.startWebServer(ServletWebServerApplicationContext.java:300)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.finishRefresh(ServletWebServerApplicationContext.java:162)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:553)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:762)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:398)
multiline 为配置多行合并 不以 “|” 的行都合并到上一行的末尾
pattern:正则表达式
negate:true 或 false;默认是false,匹配pattern的行合并到上一行;true,不匹配pattern的行合并到上一行
match:after 或 before,合并到上一行的末尾或开头
max_lines:合并最大行,默认500
timeout:一次合并事件的超时时间,默认5s,防止合并消耗太多时间甚至卡死
filebeat.prospectors:
- type: log
#开启监视,不开不采集
enabled: true
paths:
- D:\logs\projectManagement\*.log
encoding: utf-8
# logstash判断日志来源
fields:
log_source: project_management
multiline:
pattern: '^\|'
negate: true
match: after
#-------------------------- reids output ------------------------------
output.redis:
hosts: ["127.0.0.1:6379"]
key: logs
db: 4
# 超时
timeout: 5s
# 最大重试次数
max_retries: 3