logstash收集日志到Oracle

可以通过开源logstash output插件logstash-output-jdbc数据导入oracle数据库

logstash-output-jdbc插件安装（logstash-plugin list 查看已安装插件）

1.外网安装命令：bin/logstash-plugin install logstash-output-jdbc

2.离线安装：

直接从logstash-output-jdbc github 下载安装包将logstash-output-jdbc.zip放到不能联网的主机安装即可执行

命令bin/logstash-plugin install file:///home/logstash-output-jdbc.zip`

 

也可以从已经安装好的机器上把对logstash-output-jdbc进行剥离打包

剥离的命令（bin/logstash-plugin prepare-offline-pack --overwrite --output logstash-output-jdbc.zip logstash-output-jdbc）然后安装

 

3.插件安装成功后可以配置logstash的conf文件了，(如果logstash是启动状态，安装插件后要重启)

 

input{

file{

path => "/usr/local/nginx/logs/access.log"

type => "sixgod"

}

}

 

filter {

grok {

match => {"message" => "(?<client_ip>%{USERNAME}) - - \[(?<time>[0-9a-zA-Z/: +]+)\] \"%{NOTSPACE:method} %{NOTSPACE:url} %{NOTSPACE}[\"] %{INT:status} %{INT} [\"]%{USERNAME}[\"] [\"](?<http_user_agent>.*)[\"]"}

}

}

 

output{

if [type] == "sixgod" {

stdout{codec => rubydebug}

elasticsearch {

hosts => ["192.168.1.135:9200"]

index => "test-%{+YYYY.MM.dd}"

}

jdbc {

driver_jar_path => "/home/elk/work/logstash-7.3.2/vendor/jar/ojdbc7.jar" #注意要将ojdbc包放进服务器

connection_string => "jdbc:oracle:thin:username/password@IP:1521:sid"

statement => [ "INSERT INTO elk(date_time,client_ip,method,path,host,url,status) VALUES(?,?,?,?,?,?,?)","time","client_ip","method","path","host","url","status"]

}

}

}