Logstash
输入 input
input{
filter{
path=>["",""]
type=>""
start_postion=>"beginning"
}
}
其他配置项:
discoverw_interval:每隔多久检查被监听的path下是否有新文件,默认是15秒。
exclude:不想被监听的文件,可以使用glob。
stat_interval:检查文件更新间隔,默认是1秒。
start_position:读取文件的位置,读取原始文件时设置beginning从文件开始位置开始读取,设置/dev/null无论何种文件都将从文件头读取。
close_older文件超过此时间无更新,将关闭此文件的监听句柄,默认是3600秒。
ignore_older:检查文件列表时,如果文件最后修改时间超过这个值,忽略此文件,默认86400秒。
GeoIp地址查询
filter{
grok{
match=>{
"message"=>"***********"}}
geoip{
#地址解析的资源来自grok从输入中过滤出的字段
source=>"*****"
}
}
运行结果如下
{
"host" => "LAPTOP-Peanut",
"serverIp" => "10.4.**.158",
"clientIp" => "116.***.31.*,
"userId" => "11299073",
"geoip" => {
"longitude" => 121.3997,
"city_name" => "Shanghai",
"location" => {
"lat" => 31.0456,
"lon" => 121.3997
},
"ip" => "116.***.31.*",
"region_name" => "Shanghai",
"country_code3" => "CN",
"latitude" => 31.0456,
"timezone" => "Asia/Shanghai",
"country_code2" => "CN",
"region_code" => "31",
"country_name" => "China",
"continent_code" => "AS"
},
"textDuring" => "duringTime",
”mesage"=>"***************************",
"tags" => [
[0] "_dateparsefailure"
],
"@version" => "1",
"timestamp" => "2015-05-07-16:03:04",
"@timestamp" => 2018-10-10T07:45:42.178Z,
"logSource" => "WEB",
"duringTime" => 98,
"reqUrl" => "**",
"reqUri" => "/shareApp",
"device" => "**",
"refer" => "null"
}