logstash获取异常日志推送钉钉

Posted 2020-11-28

logstash.conf配置
input {
file {
path => "/data/home/services/xxx/logs/xxx.log"
#path => "/opt/test.log"
#设置logstash开始读取文件内容位置，begining为从头开始，end为只读取最新数据
start_position => "end"
}
}

output {
if ‘"errorCode":1306‘ in [message] {
#stdout { codec => rubydebug }
http {
url => "https://oapi.dingtalk.com/robot/send?access_token=xxx"
http_method => "post"
content_type => "application/json; charset=utf-8"
format => "message"
message => ‘{"msgtype":"text","text":{"content": "音视频播放异常: service:xxx ip:172.17.8.226 APP_LOG errcode is 1306"}}‘
}
}else if ‘"errorCode" : "1307"‘ in [message] {
http {
url => "https://oapi.dingtalk.com/robot/send?access_token=xx"
http_method => "post"
content_type => "application/json; charset=utf-8"
format => "message"
message => ‘{"msgtype":"text","text":{"content": "音视频播放异常: service:xx-api ip:172.17.8.226 APP_LOG errcode is 1307"}}‘
}
}
}