日志采集器windows客户端的配置释义

Posted 2020-11-19 neilyoung22

<Extension json>　　
    Module  xm_json
</Extension>
<Extension charconv>
    Module  xm_charconv
    AutodetectCharsets GBK　　　　　　　#自动检测GBK字符集 并在input中定义
</Extension>

<Extension  multiline>
    Module  xm_multiline　　　　　　　　#多行匹配　　  
    HeaderLine  /^d+-w+-d+/　　　　 #行首匹配
</Extension>

<Input access>
        Module  im_file
        File    "/home/tomcat/access.log"　　#定义了采集的日志路径，可支持通配符
        SavePos TRUE
        ReadFromLast    TRUE
        Recursive   TRUE
        RenameCheck TRUE
        PollInterval    1
        Exec   convert_fields("AUTO","utf-8");　　#表示识别GBK中的字符编码，并转化为UTF8编码
        Exec    $source = host_ip();
        Exec    $sourcetype = " tomcat-access";
        Exec    $app = "WEB";
        Exec    $filename = file_name();
</Input>

<Input catalina>
        Module  im_file
        File    "/home/tomcat/catalina.out"
        SavePos TRUE
        ReadFromLast	TRUE
        Recursive   TRUE
        RenameCheck TRUE
        PollInterval    1
        InputType   multiline
        #Exec   convert_fields("AUTO","utf-8");
        Exec    $source = host_ip();
        Exec    $sourcetype = "tomcat-catalina";
        Exec    $app = "WEB";
        Exec    $filename = file_name();
</Input>

<Output loginsight_access>
        Module  om_tcp
        Host    192.168.11.196
        Port    1516
        Exec    sleep (1000);
        Exec    $message = $raw_event;to_json();
</Output>

<Output loginsight_catalina>
        Module  om_tcp
        Host    192.168.11.196
        Port    1517
        Exec    sleep (1000);
        Exec    $message = $raw_event;to_json();
</Output>

<Route 1>
        Path    access => loginsight_access
</Route>

<Route 2>
        Path    catalina => loginsight_catalina
</Route>