我采集log时想分类提交,filebeat提交给logshath再提交给elasticsearch,
filebeat的配置如下,我希望分类三种:apache, custom, laravel:
logshath配置如下:
filebeat不是这样分类吗?
filebeat的配置如下,我希望分类三种:apache, custom, laravel:
filebeat:
prospectors:
-
paths:
- /var/log/httpd/error_log
input_type: log
document_type: apache
-
paths:
- /mnt/hgfs/www/ciboapp/storage/custom/custom-20180322.log
input_type: log
document_type: custom
-
paths:
- /mnt/hgfs/www/ciboapp/storage/logs/laravel-2018-03-27.log
input_type: log
document_type: laravel
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
multiline.timeout: 2s
output:
logstash:
hosts: ["localhost:5044"]
logshath配置如下:
input {
beats {
port => "5044"
}
}
filter {
grok {
match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
}
}
output {
if [type] == "laravel"{
elasticsearch {
hosts => ["192.168.1.80:9200"]
index => "laravel-%{+YYYY.MM.dd}"
}
}
if [type] == "apache"{
elasticsearch {
hosts => ["192.168.1.80:9200"]
index => "apache-%{+YYYY.MM.dd}"
}
}
if [type] == "custom"{
elasticsearch {
hosts => ["192.168.1.80:9200"]
index => "custom-%{+YYYY.MM.dd}"
}
}
}
如此发现不能收集到log,查了发现beats是发送了消息给logshath,但因为分类语法不匹配,所以logshath并没有提交过数据到elasticsearch。filebeat不是这样分类吗?
document_type: apache
logshath不是这样收集分类吗?if [type] == "apache"{
这里apache是匹配的。
3 个回复
shitangjiejie
赞同来自:
iloveleeyan
赞同来自:
scxh00
赞同来自: