logstash检测日志文件，将异常日志发送到钉钉的配置

input {
    file {
        path => ["/logs/tuhu.log"]
        start_position => "end"

        codec => multiline {
            pattern => "^\d{4}-\d{2}-\d{2}"
            negate => "true"
            what => "previous"
            charset => "UTF-8"
        }
    }
}

filter {
   grok {
            match => ["message","\s*%{TIMESTAMP_ISO8601}\s+(?<Level>(\S+)).*"]
            }

        if [Level] != "ERROR" {
                        drop {}
                }
}

output {
    http {
                        url => "https://oapi.dingtalk.com/robot/send?access_token=cb1f30ede9728xxxxxxxxxxxxxxxdcf9e6a76046ad7d33deb32542d4"
                        format => "message"
                        http_method => "post"
                        content_type => "application/json; charset=utf-8"
                        message => '{"msgtype":"text","text":{"content":"%{[message]}"}}'
                }    

    stdout {
        codec => rubydebug {
        
        }
    }
}

test.conf 

启动logstash

[root@iz2vc2lvbyaym45kry43ktz logstash-8.0.0]# bin/logstash -f config/test.conf