filebeat收集普通错误日志和Redis错误日志到logstash，并发送邮件告警

(base) cwj0@ubuntu:/usr/local/filebeat-7.14.0-linux-x86_64$ vim filebeat1.yml

filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/cwj0/elk/data/logs*/log_error.log 
  multiline.pattern: '^\d{4}-\d{2}-\d{2}'  # 必须为单引号''
  multiline.negate: true
  multiline.match: after
  # 包含字符
  include_lines: ["Error", "ERROR", "Exception"]
  tags: ["error"]
  tail_files: true
  # 使用 fields 模块添加字段
  fields:
    ip: 24.120.101.16

- type: log
  enabled: true
  paths:
    - /home/cwj0/elk/data/redis.log
  # 字符串包含字符(可以有多个,为或的关系),但必须要有
  include_lines: ["Error"]
  tags: ["tdh1redis"]
  tail_files: true
  # 使用 fields 模块添加字段
  fields:                     
    ip: 24.120.101.15
    log_source: redis
    log_type: redis

output.redis:
  enabled: true
  # redis地址
  hosts: ["127.0.0.1:6379"]
  # redis密码，没有密码则不添加该配置项
  # password: 123456
  # 数据存储到redis的key值
  key: errorlog
  # 数据存储到redis的第几个库
  db: 1
  # 数据存储类型
  datatype: list

logstash.conf

# 输入
input {
  redis {
        host => "127.0.0.1"
        port => 6379
        # password => "123456"
        key => "errorlog" #这里的key值和filebeat配置文件中output.redis的key值保持一致
        data_type => "list"
        db =>1
    }
}

filter {
    if [fields][log_type]  == "redis" {
       grok {
       patterns_dir => "/usr/local/logstash-7.14.0/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.3.1/patterns/ecs-v1"
       match => { "message" => "%{REDISLOG}" }
     }
   }
}

output {
    email {
        port => 587
        address => "smtp.qq.com"
        username => "3201614960@qq.com"
        password => "laoaeyfjpyiyd***"
        authentication => "plain"
        contenttype => "text/plain; charset=UTF-8"
        from => "3201614960@qq.com"
        subject => "错误告警"
        to => "3201614960@qq.com"
        use_tls => true
        via => "smtp"
        domain => "smtp.qq.com"
        body => "服务器IP: %{[fields][ip]}\n日志文件: %{[log][file][path]}\n异常信息: \n%{message}"
    }
}

日志文件：
/home/cwj0/elk/data/logs*/log_error.log

2022-10-20 10:39:19.527 [http-nio-8199-exec-2] ERROR org.apache.coy.HttpPcessor - Errror
    at org.apache.sfddsfsddsfsd
    at org.apache.sdfsdsfssdfsfsfsf

/home/cwj0/elk/data/redis.log

6066:M 06 Jul 17:40:49.611 # Server started, Redis version 3.1.999
6066:M 06 Jul 17:40:49.627 * DB loaded from disk: 0.016 seconds
6066:M 06 Jul 17:40:49.627 * The server is now ready to accept connections on port 6379
6066:M 06 Jul 18:29:20.009 * DB saved on disk
24661:S 17 17 Oct 09:23:01.940 # Error condition on socket for SYNC: Connection refused

邮件告警结果：