input {file {
type => "zj_mysql"
path => ["/data01/applog_backup/zjzc_log/zj-mysql01-slowlog.*"]
}
file {
type => "wj_mysql"
path => ["/data01/applog_backup/winfae_log/wj-mysql01-slowlog.*"]
}
}
filter {
multiline {
pattern =>"^\s+#\s+Time:"
negate=>true
what=>"previous"
}
}
output {
if [type] == "zj_mysql" {
redis {
host => "192.168.32.67"
data_type => "list"
key => "zj_mysql:redis"
port=>"6379"
password => "1234567"
}
}
else if [type] == "wj_mysql"{
redis {
host => "192.168.32.67"
data_type => "list"
key => "wj_mysql:redis"
port=>"6379"
password => "1234567"
}
}
}
multiline 多行匹配:
这个插件很简单,就是把当前行的数据添加到前面一行后面,直到新进的当前行匹配^# Time:正则为止。
看下slow log日志；
LIMIT 0, 50;
# Time: 160826 14:56:36
# User@Host: zjzc_dba[zjzc_dba]
# Query_time: 8.897828 Lock_time: 0.000263 Rows_sent: 1 Rows_examined: 25721574
SET timestamp=1472194596;
SELECT (SUM(repay.`yieldBalance`)-SUM(TRUNCATE(holding.`investBalance`*stock.productYield*pr.duration/pr.daysOfYear,pr.`precision`))) AS totalAddBenefit
FROM GambleStockIndex stock
INNER JOIN `Product` po ON po.sn = stock.productSn
INNER JOIN ProductRepay pr on po.sn = pr.productSn
INNER JOIN `ClientInvestOrder` co ON co.`orderNo` = stock.`orderNo`
INNER JOIN `ClientProductHolding` holding ON holding.`investSn` = co.`sn`
INNER JOIN `ProductRepayment` repay ON repay.`holdingSn` = holding.`sn`
WHERE stock.`status`=2 and po.status =5
LIMIT 0, 50;
# Time: 160826 15:17:06
# User@Host: zjzc_dba[zjzc_dba] @ [115.236.160.83] Id: 5534343
# Query_time: 8.842579 Lock_time: 0.000178 Rows_sent: 1 Rows_examined: 25721574
SET timestamp=1472195826;
SELECT (SUM(repay.`yieldBalance`)-SUM(TRUNCATE(holding.`investBalance`*stock.productYield*pr.duration/pr.daysOfYear,pr.`precision`))) AS totalAddBenefit
FROM GambleStockIndex stock
INNER JOIN `Product` po ON po.sn = stock.productSn
INNER JOIN ProductRepay pr on po.sn = pr.productSn
INNER JOIN `ClientInvestOrder` co ON co.`orderNo` = stock.`orderNo`
INNER JOIN `ClientProductHolding` holding ON holding.`investSn` = co.`sn`
INNER JOIN `ProductRepayment` repay ON repay.`holdingSn` = holding.`sn`
WHERE stock.`status`=2 and po.status =5
LIMIT 0, 50;
1033
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
