logstash增加配置文件

最新推荐文章于 2025-11-19 19:19:27 发布
原创最新推荐文章于 2025-11-19 19:19:27 发布 · 1.3k 阅读
0 ·
CC 4.0 BY-SA版权
本文介绍如何使用Logstash配置文件收集特定路径下的.log文件，通过TCP和file输入插件接收JSON格式的日志数据，并利用grok过滤器解析日志消息。
在conf.d目录下创建文件logs.conf用于收集*.log中的日志
input {
    tcp {
        port => 4560
        codec => json
    }
    file {
        path => "/data/securityopdata/synctool/logs/*.log"
        type => "logfile"
        start_position => "beginning"
        #sincedb_path => "/dev/null"
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            what => "previous"
            negate => true
        }
        add_field => {
            HOSTNAME => "XXX的空间"
            project_name => "synctool"                                                                                                                                                                         
        }                                                                                                                                                                                                      
    }                                                                                                                                                                                                          
    file {                                                                                                                                                                                                     
        path => "/data/securityopdata/syncapi/logs/*.log"                                                                                                                                                      
        type => "logfile"                                                                                                                                                                                      
        start_position => "beginning"                                                                                                                                                                          
        #sincedb_path => "/dev/null"                                                                                                                                                                           
        codec => multiline {                                                                                                                                                                                   
            pattern => "^%{TIMESTAMP_ISO8601}"                                                                                                                                                                 
            what => "previous"                                                                                                                                                                                 
            negate => true                                                                                                                                                                                     
        }                                                                                                                                                                                                      
        add_field => {                                                                                                                                                                                         
            HOSTNAME => "XXXXX的空间"                                                                                                                                                                         
            project_name => "syncapi"                                                                                                                                                                          
        }                                                                                                                                                                                                      
    }                                                                                                                                                                                                          
}                                                                                                                                                                                                              
                                                                                                                                                                                                               
filter{                                                                                                                                                                                                        
    if([project_name] == "syncapi" or [project_name] == "synctool"){                                                                                                                                           
        grok {                                                                                                                                                                                                 
            match => {                                                                                                                                                                                         
                "message" => "%{TIMESTAMP_ISO8601:createTime}\s*\[\s*%{WORD:level}\s*\]\s*\[\s*(?<logger_name>.*?)\s*\]\s*(?<message>.*)"                                                                      
            }                                                                                                                                                                                                  
            overwrite => ["message"]                                                                                                                                                                           
        }                                                                                                                                                                                                      
    }                                                                                                                                                                                                          
    date {                                                                                                                                                                                                     
        match => ["createTime","yyyy-MM-dd HH:mm:ss","UNIX"]                                                                                                                                                   
        #target => "asdfasf"                                                                                                                                                                                   
    }                                                                                                                                                                                                          
}