logstash

Logstash

输入 input

input{
	filter{
		path=>["",""]
		type=>""
		start_postion=>"beginning"
	}
}

其他配置项：
discoverw_interval:每隔多久检查被监听的path下是否有新文件，默认是15秒。
exclude:不想被监听的文件，可以使用glob。
stat_interval:检查文件更新间隔，默认是1秒。
start_position:读取文件的位置，读取原始文件时设置beginning从文件开始位置开始读取，设置/dev/null无论何种文件都将从文件头读取。
close_older文件超过此时间无更新，将关闭此文件的监听句柄，默认是3600秒。
ignore_older:检查文件列表时，如果文件最后修改时间超过这个值，忽略此文件，默认86400秒。
GeoIp地址查询

filter{
	grok{
	match=>{
	"message"=>"***********"}}
	geoip{
	#地址解析的资源来自grok从输入中过滤出的字段
	source=>"*****"
	}
}
运行结果如下
{
      "host" => "LAPTOP-Peanut",
  "serverIp" => "10.4.**.158",
  "clientIp" => "116.***.31.*,
    "userId" => "11299073",
     "geoip" => {
         "longitude" => 121.3997,
         "city_name" => "Shanghai",
          "location" => {
        "lat" => 31.0456,
        "lon" => 121.3997
    },
                "ip" => "116.***.31.*",
       "region_name" => "Shanghai",
     "country_code3" => "CN",
          "latitude" => 31.0456,
          "timezone" => "Asia/Shanghai",
     "country_code2" => "CN",
       "region_code" => "31",
      "country_name" => "China",
    "continent_code" => "AS"
},
"textDuring" => "duringTime",
”mesage"=>"***************************",
"tags" => [
    [0] "_dateparsefailure"
],
  "@version" => "1",
 "timestamp" => "2015-05-07-16:03:04",
"@timestamp" => 2018-10-10T07:45:42.178Z,
 "logSource" => "WEB",
"duringTime" => 98,
    "reqUrl" => "**",
    "reqUri" => "/shareApp",
    "device" => "**",
     "refer" => "null"
     }