linux-ELK-Logstash配置

4-Logstash配置文件

---

游戏日志配置

input {
udp{
id => "game-udp-1"
host => "192.168.2.240"
port => 9603
type => string 
}
stdin { }
}

filter {
     mutate{
     split => ["message","||"]
        add_field =>   {
            "appname" => "%{[message][0]}"
        }
        add_field =>   {
            "msg" => "%{[message][1]}"
        }
        remove_field=> ["message"]
    }
}

output {
elasticsearch {
hosts => "192.168.2.240:9200"
index => "%{[appname]}-%{+YYYYMMdd}"
codec => json { charset => "UTF-8" }
}
stdout {
codec => rubydebug {}
}
}

平台日志配置

input {
tcp {
	id => "web-log-1"
     host => "192.168.2.221"
     port => 9601
     mode => "server"
     ssl_enable => false
     codec => json { charset => "UTF-8" }
}
tcp {
	id => "service-log-1"
     host => "192.168.2.221"
     port => 9602
     mode => "server"
     ssl_enable => false
     codec => json { charset => "UTF-8" }
}
stdin { }
}

output {
elasticsearch {
hosts => "192.168.2.221:9200"
index => "%{[appname]}-%{+YYYYMMdd}"
codec => json { charset => "UTF-8" }
}
stdout {
codec => rubydebug {}
}
}