日志采集器windows客户端的配置释义-优快云博客

本文介绍了一种针对Tomcat服务器的日志采集配置方案，包括access日志和catalina日志的采集路径设定、字符编码转换、多行匹配设置等，并详细说明了如何将这些日志发送到指定的服务器端口进行后续处理。

<Extension json>　　
    Module  xm_json
</Extension>
<Extension charconv>
    Module  xm_charconv
    AutodetectCharsets GBK　　　　　　　#自动检测GBK字符集 并在input中定义
</Extension>

<Extension  multiline>
    Module  xm_multiline　　　　　　　　#多行匹配　　  
    HeaderLine  /^\d+-\w+-\d+/　　　　 #行首匹配
</Extension>

<Input access>
        Module  im_file
        File    "/home/tomcat/access.log"　　#定义了采集的日志路径，可支持通配符
        SavePos TRUE
        ReadFromLast    TRUE
        Recursive   TRUE
        RenameCheck TRUE
        PollInterval    1
        Exec   convert_fields("AUTO","utf-8");　　#表示识别GBK中的字符编码，并转化为UTF8编码
        Exec    $source = host_ip();
        Exec    $sourcetype = " tomcat-access";
        Exec    $app = "WEB";
        Exec    $filename = file_name();
</Input>

<Input catalina>
        Module  im_file
        File    "/home/tomcat/catalina.out"
        SavePos TRUE
        ReadFromLast	TRUE
        Recursive   TRUE
        RenameCheck TRUE
        PollInterval    1
        InputType   multiline
        #Exec   convert_fields("AUTO","utf-8");
        Exec    $source = host_ip();
        Exec    $sourcetype = "tomcat-catalina";
        Exec    $app = "WEB";
        Exec    $filename = file_name();
</Input>

<Output loginsight_access>
        Module  om_tcp
        Host    192.168.11.196
        Port    1516
        Exec    sleep (1000);
        Exec    $message = $raw_event;to_json();
</Output>

<Output loginsight_catalina>
        Module  om_tcp
        Host    192.168.11.196
        Port    1517
        Exec    sleep (1000);
        Exec    $message = $raw_event;to_json();
</Output>

<Route 1>
        Path    access => loginsight_access
</Route>

<Route 2>
        Path    catalina => loginsight_catalina
</Route>

转载于:https://www.cnblogs.com/neilyoung22/p/9212393.html