filebeat+logstash配置

一. filebeat.yml的配置

filebeat.prospectors:
- input_type: log
paths:
- /tmp/logs/optimus-activity-api.log
document_type: "czh-uat-activity"
multiline:
pattern: '^\s*("{)'
negate: true
match: after
max_lines: 1000
timeout: 30s
fields:
logsource: uat
logtype: czh-uat-activity

- input_type: log
paths:
- /tmp/logs/optimus-coupon-api.log
document_type: "czh-uat-coupon"
fields:
logsource: uat139.224.146.96
logtype: czh-uat-coupon

- input_type: log
paths:
- /tmp/logs/optimus-bean-api.log
document_type: "czh-uat-bean"
fields:
logsource: uat
logtype: czh-uat-bean

- input_type: log
paths:
- /tmp/logs/optimus-external-api.log
document_type: "czh-uat-external-web"
fields:
logsource: uat
logtype: czh-uat-external-web

- input_type: log
paths:
- /tmp/logs/api-gateway-production.log
document_type: "czh-uat-gateway"
fields:
logsource: uat
logtype: czh-uat-gateway

- input_type: log
paths:
- /tmp/logs/optimus-manage-api.log
document_type: "czh-uat-manage"
fields:
logsource: uat
logtype: czh-uat-manage

- input_type: log
paths:
- /tmp/logs/optimus-order-api.log
document_type: "czh-uat-api-order"
fields:
logsource: uat
logtype: czh-uat-api-order

- input_type: log
paths:
- /tmp/logs/optimus-parent-plus-api.log
document_type: "czh-uat-parent-plus"
fields:
logsource: uat
logtype: czh-uat-parent-plus

- input_type: log
paths:
- /tmp/logs/optimus-user-api.log
document_type: "czh-uat-user-production"
fields:
logsource: uat
logtype: czh-uat-user-production

將採集的日誌導入logstash里
output.logstash:
hosts: ["192.168.102.38:5044"]

二. logstash的配置：

1.------input配置--------

input {
beats {
port => 5044
}

}

if [fields][logtype] == "czh-uat-activity" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-coupon" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-bean" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-external-web" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-gateway" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-manage" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-api-order" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-parent-plus" {
json {
source => "message"
target => "data"
}
}

if [fields][logtype] == "czh-uat-user-production" {
json {
source => "message"
target => "data"
}
}

-------output-配置------

if [fields][logtype] == "czh-uat-activity"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]   #將處理後的日誌存儲到 elasticsearch，多個IP是因為做了集群
index => "czh-uat-activity"   #創建索引
}
}

if [fields][logtype] == "czh-uat-coupon"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-coupon"
}
}

if [fields][logtype] == "czh-uat-bean"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-bean"
}
}

if [fields][logtype] == "czh-uat-external-web"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-external-web"
}
}

if [fields][logtype] == "czh-uat-gateway"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-gateway"
}
}

if [fields][logtype] == "czh-uat-manage"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-manage"
}
}

if [fields][logtype] == "czh-uat-api-order"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-api-order"
}
}

if [fields][logtype] == "czh-uat-parent-plus"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-parent-plus"
}
}

if [fields][logtype] == "czh-uat-user-production"{
elasticsearch {
hosts => ["192.168.102.17:9200","192.168.102.26:9200"]
index => "czh-uat-user-production"
}
}