logstash日志输出到mysql_Logstash将解析的日志插入MySQL数据库

1.首先Logstash需要安装logstash-output-jdbc插件(以下方式基于docker)

Dockerfile如下:

FROM logstash:7.4.0

RUN sed -i 's#https://rubygems.org#https://gems.ruby-china.com#g' Gemfile && logstash-plugin install logstash-output-jdbc

2.解析nginx日志

date {

match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"] #解析时间

}

urldecode {

field => "Http_Request" #请求日志转为中文

}

geoip { #获取IP插件

database => "/usr/share/logstash/geodb/GeoLite2-City.mmdb"

source => "Client_IP"

target => "geoip"

fields => ["country_name","region_name", "city_name", "ip", "longitude", "latitude", "location"]

add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]

a