logstash php.log,logstash获取php_error.log,php-fpm.log,php-fpm-slow.log

运维开发网 https://www.qedev.com

2020-03-20 10:49

出处：网络作者：运维开发网整理

php-fpm-slow.log的过滤配置如下： filter {   if [type] == "php-fpm-slow" {     multiline {       pattern => '^(\[0x0|script_filename|$)'       what => 'previous'       negate => false     }    grok {       pat

php-fpm-slow.log的过滤配置如下：

filter {

if [type] == "php-fpm-slow" {

multiline {

pattern => '^(\[0x0|script_filename|$)'

what => 'previous'

negate => false

}

grok {

patterns_dir => '/usr/local/logstash/patterns'

match => [

"message", "%{PHP_FPM_SLOW_LOG}"

]

}

}

...

}

/usr/local/logstash/patterns/php-fpm的内容如下：

PHP_DATE_TIME %{MONTHDAY}-%{MONTH}-%{YEAR}\s+%{TIME}

PHP_FPM_SLOW_LOG_FIRST_LINE \[%{PHP_DATE_TIME:timestamp}\]  \[%{GREEDYDATA:php_fpm_pool}\] pid {POSINT}

PHP_FPM_SLOW_LOG ^\[%{GREEDYDATA:stack_addr}\] %{GREEDYDATA:func_name} %{UNIXPATH:script_path}

php_error.log的过滤配置如下：

if [type] == "php-error" {

grok{

match => [ "message", "\[%{%{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR} %{TIME}:datetime}\]\s+%{DATA:zone}\]\s+PHP\s+%{LOGLEVEL:severity}:\s+%{GREEDYDATA:errormessage}" ]

}

}

php-fpm.log的过滤配置如下：

filter {

if [type] == "php-fpm-error" {

grok{

match => [ "message", "\[%{%{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR} %{TIME}:datetime}\]\s+%{LOGLEVEL:severity}:\s+%{GREEDYDATA:errormessage}" ]

}

}

｝

分享到

0

0

0