filebeat+logstash收集postgres慢查询日志

背景：在 win10下docker启动postgres 、python连接postgres，创建表和插入数据 以及ELK+Filebeat的基础上进行

一、Filebeat端处理

1. 配置文件修改

1.1 filebeat.yml配置文件新增数据源类型

- type: log
  enabled: true
  paths:
    - /usr/share/filebeat/log/facilities/*/*.log
  tags: ["facility"]
  fields:
    env: test
    source: facility
    type: logs
  fields_under_root: true
  multiline.pattern: '^\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}'
  multiline.negate: true
  multiline.match: after
  include_lines: [ 'duration' ]

 1.2 logstash.conf配置文件中新增过滤类型处理

if [source] == "facility" {
        grok {
            match => [ "message", "(?m)^%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{TZ:timezone}%{SPACE}\[%{POSINT