logstash配置文件

最新推荐文章于 2022-09-02 15:42:54 发布

奥格瑞玛-毁灭之锤

最新推荐文章于 2022-09-02 15:42:54 发布

阅读量404

点赞数

分类专栏：个人代码文章标签： elasticsearch C++ 总结

本文链接：https://blog.csdn.net/zrs19800702/article/details/52958344

版权

个人代码专栏收录该内容

6 篇文章 0 订阅

订阅专栏

语义转换测试链接

http://grokdebug.herokuapp.com/

日志格式

zrsname objectname 0
zrs objec_tname 1
zrsdddde z1ong 1
zrsdddde z1ong1 2
zrsdddde z1ong2 3
zrsdddde z1ong3 4
zrsdddde z1ong4 5
zrsdddde z1ong5 6
zrsdddde z1ong6 7

input{

    file {
        type => "logs"
        path => "/home/ELK/logstash-all-2.4.0/data/test.log"
        start_position => "beginning"
        #exclude => ["*.log"]
        #sincedb_path => "/dev/null"
    }
    #stdin{type => "logs"}
}

filter {
    if [type] == "logs" {
        grok {
            #match => ["message", "%{COMBINEDAPACHELOG}"]
            #patterns_dir => "/path/to/your/own/patterns"
            match => { "message" => "%{WORD:bucket} %{WORD:object} %{NUMBER:operate:int}"}
        }

        #date {
        #    match => ["operatedate", "yyyy-MM-dd-HH:mm:ss"]
        #}

        #overwrite => ["message"]
        mutate {
            remove => [ "message" ]
            remove => [ "@version" ]
            #remove => [ "@path" ]
            #remove => [ "@host" ]
            #remove => [ "@type" ]
            #add_field => {"bucket" => "%{bucketname}"
            #          "object" => "%{objectname}"
            #          "result" => "%{operateresult}"
            #          "operate" => "%{operatedate}"
            #}
        }
    }
}

output {
    elasticsearch {
        index => "logstash--%{+dd.MM.YYYY}"
        hosts => "10.75.144.208"
    }
    stdout { codec => rubydebug }

}

输出结果图片