oldboy es和logstash
Posted alexhe
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了oldboy es和logstash相关的知识，希望对你有一定的参考价值。
logstash:
input:https://www.elastic.co/guide/en/logstash/current/input-plugins.html
input {
file {
path =>"/var/log/messages"
type => "system"
start_position =>"beginning"
}
file {
path =>"/var/log/elasticsearch/alex.log"
type => "es-error"
start_position =>"beginning"
}
}
output:https://www.elastic.co/guide/en/logstash/current/output-plugins.html
output {
if [type] == "system" {
elasticsearch {
hosts=>["192.168.1.1:9200"]
index=>"system-%{+YYYY.MM.dd}"
}
}
if [type] == "es-error" {
elasticsearch {
hosts=>["192.168.1.1:9200"]
index=>"es-error-%{+YYYY.MM.dd}"
}
}
}
收集java报错堆栈信息，（多行报错）
需要codec plugin
input {
stdin {
codec => multiline {
pattern => "regexp"
negate => "true or false"
what =>"previous or next"//合并到上一行还是下一行
}
}
}
例子1：
input {
stdin {
codec => multiline {
pattern => "^\["
negate => "true"
what =>"previous"
}
}
}
output {
stdout {
codec => "rubydebug"
}
}
案例2：
input {
file {
path =>"/var/log/messages"
type => "system"
start_position =>"begining"
}
file {
path =>"/var/log/elasticsearch/alex.log"
type => "es-error"
start_position =>"beginning"
codec => multiline {
pattern => "^\["
negate => "true"
what =>"previous"//合并到上一行还是下一行
}
}
}
output {
if [type] == "system" {
elasticsearch {
hosts=>["192.168.1.1:9200"]
index=>"system-%{+YYYY.MM.dd}"
}
}
if [type] == "es-error" {
elasticsearch {
hosts=>["192.168.1.1:9200"]
index=>"es-error-%{+YYYY.MM.dd}"
}
}
}
以上是关于oldboy es和logstash的主要内容，如果未能解决你的问题，请参考以下文章
批量创建10个系统帐号oldboy01-oldboy10并设置密码，密码为随机数，要求字符和数字等混