ELK技术3--ELK收集java日志多行匹配模式

一.官方地址

https://www.elastic.co/guide/en/beats/filebeat/6.6/multiline-examples.html
因为java日志的输出信息非常多，需要将多行拼成一个事件，所以需要多行匹配模式
因为elasticsearch本身就是java开发的，所以我们可以直接收集ES的日志

二.ELK收集java日志多行匹配模式

[root@m01 soft]# systemctl stop tomcat.service
[root@m01 soft]# cat /etc/filebeat/filebeat.yml
filebeat.inputs:
#################nginx#############
- type: log
  enabled: true
  paths:
    - /var/log/nginx/access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["access"]

- type: log
  enabled: true
  paths:
    - /var/log/nginx/error.log
  tags: ["error"]

#################tomcat#############
- type: log
  enabled: true
  paths:
    - /var/log/tomcat/localhost_access_log.*.txt
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["tomcat"]

#################es#############
- type: log
  enabled: true
  paths:
    - /var/log/elasticsearch/elasticsearch.log
  tags: ["es"]
  multiline.pattern: '^\['        //多行匹配模式设置
  multiline.negate: true
  multiline.match: after
#################output#############
setup.kibana:
  host: "10.0.0.51:5601"

output.elasticsearch:
  hosts: ["10.0.0.51:9200"]
  #index: "nginx-%{[beat.version]}-%{+yyyy.MM}"
  indices:
    - index: "nginx-access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "access"
    - index: "nginx-error-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "error"
    - index: "tomcat-access-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "tomcat"
    - index: "es-java-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "es"

setup.template.name: "nginx"
setup.template.pattern: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true

[root@m01 soft]# systemctl restart filebeat
制造错误：
[root@m01 soft]# vim /etc/elasticsearch/elasticsearch.yml
hhttp.port: 9200
[root@m01 soft]# systemctl restart elasticsearch.service
[root@m01 soft]# tail -f /var/log/elasticsearch/elasticsearch.log//查看是否产生错误日志
修改过来
[root@m01 soft]# vim /etc/elasticsearch/elasticsearch.yml
http.port: 9200
[root@m01 soft]# systemctl restart elasticsearch.service
[root@m01 soft]# systemctl restart filebeat.service

三.查看