logstash匹配filebeat传递的log.file.path

一、filebeat容器

1. d:/usr2/local/etc/filebeat/目录下filebeat.yml文件配置

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /usr/share/filebeat/log/apps/*/*.log

output.logstash:
    hosts: ["192.168.1.110:5044"]

2. 启动filebeat

docker run -v /d/usr/share/filebeat/apps/log:/usr/share/filebeat/log/apps -v /d/usr2/local/etc/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml --name filebeat1 elastic/filebeat:7.7.0

二、logstash容器

1. d:/usr2/local/etc/logstash/pipeline1目录下logstash.conf配置文件

input { 
    stdin { } 
    beats {
        port => 5044
    }
}

filter {
    ruby {
        code => "
            path = event.get('log')['file']['path']
            puts format('path = %<path>s', path: path)
            if (!path.nil?) && (!path.empty?)
                event.set('app', path.split('/')[-2])
            end
        "
    }
}

output {
	stdout { codec => rubydebug }
}

2. 启动logstash容器

docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 -p 5044:5044 logstash:7.7.0

三、日志文件

1. d:/usr/share/filebeat/apps/log/test目录下spring-2020-05-27.log

2020-05-27 17:54:50.805 DEBUG 8296 --- [scheduling-1] org.jooq.tools.LoggerListener            : Executing query          : select id from user

四、查看结果

从以上结果可以看出获取 log.file.path成功