linux日志抓取error,logstash获取异常日志推送钉钉

logstash.conf配置

input {

file {

path => "/data/home/services/xxx/logs/xxx.log"

#path => "/opt/test.log"

#设置logstash开始读取文件内容位置，begining为从头开始，end为只读取最新数据

start_position => "end"

}

}

output {

if '"errorCode":1306' in [message] {

#stdout { codec => rubydebug }

http {

url => "https://oapi.dingtalk.com/robot/send?access_token=xxx"

http_method => "post"

content_type => "application/json; charset=utf-8"

format => "message"

message => '{"msgtype":"text","text":{"content": "音视频播放异常: service:xxx ip:172.17.8.226 APP_LOG errcode is 1306"}}'

}

}else if '"errorCode" : "1307"' in [message] {

http {

url => "https://oapi.dingtalk.com/robot/send?access_token=xx"

http_method => "post"

content_type => "application/json; charset=utf-8"

format => "message"

message => '{"msgtype":"text","text":{"content": "音视频播放异常: service:xx-api ip:172.17.8.226 APP_LOG errcode is 1307"}}'

}

}

}