ELK-收集java日志

收集logstash的日志，把日志输出用正则匹配
[root@linux-node3 conf.d]# vim /etc/logstash/conf.d/java.conf

input {
   file {
        path => "/var/log/logstash/logstash-plain.log"
        type => "javalog"
        codec => multiline {
        pattern => "^\[(\d{4}-\d{2}-\d{2})"
        negate => true
        what => "previous"
        }}
}

output {
  elasticsearch {
    hosts => ["10.0.0.17:9200"]
    index => "javalog-17-%{+YYYY.MM}"
  }
}

[root@linux-node3 conf.d]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/java.conf –t
[root@linux-node3 conf.d]# systemctl restart logstash
如果不发生变化，自己复制点日志进去