收集mysql慢查询日志进elk

1，首先mysql开启慢查询日志

vim /etc/mysql/mysql.conf.d/mysqld.cnf
#添加配置，这块目录可以自定义
slow_query_log = ON
slow_query_log_file = /var/lib/mysql/slow_query.log
long_query_time = 2

#然后重启mysql服务
service mysqld restart

2，然后配置filebeat

vim /etc/filebeat/filebeat.yml
#在filebeat.prospectors:下添加如下配置
- input_type: log
  paths:
    #我mysql是docker部署，容器内的/var/lib/mysql/slow_query.log路径对应宿主机的/data/vip/mysql/mysqldb/slow_query.log目录
    - /data/vip/mysql/mysqldb/slow_query.log
  document_type: slowQuery
  #多行合并配置
  multiline.pattern: ^(# Time)
  multiline.negate: true
  multiline.match: after
  #合并超时时间
  multiline.timeout: 5s
  fields:
    log_type: slow_query_log
  fields_under_root: true

elk配置可以参考我之前博文https://blog.youkuaiyun.com/u011870280/article/details/84579164

这里只重点介绍mysql慢查询配置

3.logstash配置

vim /etc/logstash/conf.d/11-nginx.conf
#添加
if [log_type] == "slow_query_log" {
    grok {
      match => [ "message", "(?m)^#\s+User@Host:\s+%{USER:user}\[[^\]]+\]\s+@\s+%{WORD}?\s+\[%{IP:ip}\]\s+Id:\s+%{NUMBER:id}\n#\s+Query_time:\s+%{NUMBER:query_time:float}\s+Lock_time:\s+%{NUMBER:lock_time:float}\s+Rows_sent:\s+%{NUMBER:rows_sent:int}\s+Rows_examined:\s+%{NUMBER:rows_examined:int}\nSET\s+timestamp=%{NUMBER:timestamp};\n%{GREEDYDATA:sql}" ]
    }
    date {
      match => [ "unixtime", "UNIX" ]
      target => "@timestamp"
      remove_field => "unixtime"
    }
}

4,完成