ELK简单配置

input {
file {
path => ["/usr/local/kencery/tomcat/logs/catalina.out"]
type => "bas"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter {
multiline {
pattern => "^\s*xxx\s*.*"         手机以空格开头  中间含有xxxx 之后再以空格的日志
what => "previous"
}
}

output{
if [type] == "bas"
{
elasticsearch{
hosts=>["10.83.52.108:9200"]
action=>"index"
index=>"bas"
}
}
}

转载于:https://www.cnblogs.com/xiaopaipai/p/9243846.html