ELK 6.2.4 日志处理之conf定义

最新推荐文章于 2022-02-02 15:13:37 发布

原创最新推荐文章于 2022-02-02 15:13:37 发布 · 272 阅读

0 ·

CC 4.0 BY-SA版权

java 同时被 2 个专栏收录

12 篇文章

订阅专栏

Logging

7 篇文章

订阅专栏

处理的格式配置

input {
    file {

        path => ["/root/elk/bigdata/rsyslog/*.log"]
        codec => plain {
            charset => "UTF-8"
        }

    }
}
filter {
grok {
 match => { "message" => "%{TIMESTAMP_ISO8601:uploadclient} %{IP:ip} time: %{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY} %{TIME};danger_degree:%{NUMBER:danger_degree};breaking_sighn:%{NUMBER:breaking_sighn};event:\[%{NUMBER:event_id}\]%{GREEDYDATA:event_msg};src_addr:%{IP:src
_addr};src_port:%{NUMBER:src_port};dst_addr:%{IP:dst_addr};dst_port:%{NUMBER:dst_port};proto:%{WORD:proto};user:"}}
}
output {

    stdout {
        codec => rubydebug
    }

    elasticsearch {
        index => "zwy-syslog-%{+YYYY.MM.dd}"
        hosts => "192.166.229.7:9200"
        user => "elastic"
        password => "CMBkC0JYyoMrLyYht1TU"

    }
}