input {
file {
path => "/root/logs/*/*.log"
start_position => beginning
type => "applog"
codec => json {
charset => "UTF-8"
}
}
file {
path => "/root/logs/drtPersonCenter/*.log"
start_position => beginning
type => "personcenter"
codec => json {
charset => "UTF-8"
}
}
file {
path => "/root/logs/drtFinance/*.log"
start_position => beginning
type => "finance"
codec => json {
charset => "UTF-8"
}
}
file {
path => "/root/logs/drtElec/*.log"
start_position => beginning
type => "elec"
codec => json {
charset => "UTF-8"
}
}
file {
path => "/root/logs/drtShop/*.log"
start_position => beginning
type => "shop"
codec => json {
charset => "UTF-8"
}
}
file {
path => "/root/logs/drtStatistics/*.log"
start_position => beginning
type => "statistics"
codec => json {
charset => "UTF-8"
}
}
file {
path => "/root/logs/drtOperationPlatform/*.log"
start_position => beginning
type => "operationPlatform"
codec => json {
charset => "UTF-8"
}
}
}
filter {
mutate {
split => [ "upstreamtime", "," ]
}
}
output {
if "_grokparsefailure" in [tags] {
}else{
if [type] == "applog"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["applog"]
}
}
if [type] == "personcenter"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["person_logs"]
}
}
if [type] == "finance"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["finance_logs"]
}
}
if [type] == "elec"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["elec_logs"]
}
}
if [type] == "shop"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["shop_logs"]
}
}
if [type] == "statistics"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["statistics_logs"]
}
}
if [type] == "operationPlatform"{
elasticsearch {
hosts => ["http://192.168.240.15:9200"]
index => ["opr_logs"]
}
}
}
stdout { codec => rubydebug }
}
2374
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
