logstash获取php_error.log,php-fpm.log,php-fpm-slow.log

php-fpm-slow.log的过滤配置如下：
filter {

  if [type] == "php-fpm-slow" {

    multiline {

      pattern => '^(\[0x0|script_filename|$)'

      what => 'previous'

      negate => false

    }

   grok {

      patterns_dir => '/usr/local/logstash/patterns'

      match => [

        "message", "%{PHP_FPM_SLOW_LOG}"

      ]

    }

  }

...

}

/usr/local/logstash/patterns/php-fpm的内容如下：

PHP_DATE_TIME %{MONTHDAY}-%{MONTH}-%{YEAR}\s+%{TIME}

PHP_FPM_SLOW_LOG_FIRST_LINE \[%{PHP_DATE_TIME:timestamp}\]  \[%{GREEDYDATA:php_fpm_pool}\] pid {POSINT}

PHP_FPM_SLOW_LOG ^\[%{GREEDYDATA:stack_addr}\] %{GREEDYDATA:func_name} %{UNIXPATH:script_path}

php_error.log的过滤配置如下：

if [type] == "php-error" {
                grok{
                        match => [ "message", "\[%{%{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR} %{TIME}:datetime}\]\s+%{DATA:zone}\]\s+PHP\s+%{LOGLEVEL:severity}:\s+%{GREEDYDATA:errormessage}" ]
                }
        }

php-fpm.log的过滤配置如下：

filter {
        if [type] == "php-fpm-error" {
                grok{
                        match => [ "message", "\[%{%{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR} %{TIME}:datetime}\]\s+%{LOGLEVEL:severity}:\s+%{GREEDYDATA:errormessage}" ]
                }
        }

｝