通过logstash将日志分级存储

1、logstash安装

wget https://artifacts.elastic.co/downloads/logstash/logstash-7.x.x.tar.gz

或者提前下载好，上传到主机进行解压安装

2、解压

tar -xzvf logstash-7.x.x.tar.gz

3、进入logstash目录

cd logstash-7.x.x

4、在logstash目录下创建一个配置文件：logstash.conf

编辑配置文件，如

input {
  file {
    path => "/path/to/your/logfile.log"
    start_position => "beginning"
  }
}

filter {
  if [message] =~ "INFO" {
    mutate {
      add_field => { "log_level" => "info" }
    }
  } else if [message] =~ "ERROR" {
    mutate {
      add_field => { "log_level" => "error" }
    }
  } else if [message] =~ "DEBUG" {
    mutate {
      add_field => { "log_level" => "debug" }
    }
  } else {
    mutate {
      add_field => { "log_level" => "other" }
    }
  }
}

output {
  if [log_level] == "info" {
    file {
      path => "/path/to/info_logs/info.log"
    }
  } else if [log_level] == "error" {
    file {
      path => "/path/to/error_logs/error.log"
    }
  } else if [log_level] == "debug" {
    file {
      path => "/path/to/debug_logs/debug.log"
    }
  } else {
    file {
      path => "/path/to/default_logs/default.log"
    }
  }
}

上述配置中，‘file’输入插件读取“/path/to/your/logfile.log”文件，并通过'filter'插件根据日志消息中的关键字（INFO、ERROR、DEBUG）添加一个“log_level”字段。最后通过‘output’插件将数据分别输出到不同级别的日志文件中去。

5、运行logstash

在logstash目录下执行启动命令

bin/logstash -f logstash.conf