elk文件

素颜马尾好姑娘i 2021-09-20 12:50 282阅读 0赞

=================正则匹配
    [root@web02 conf.d]# cat apache-grok.conf 
    input{
      file {
        path => "/var/log/httpd/access_log"
        type => "apache_access.log"
        start_position => "beginning"
      }
    }
    
    filter {
      if [type] == "apache_access.log" {
        grok {
          match => {"message" => "%{COMBINEDAPACHELOG}" } # 内置httpd正则
          }
      }
    }
    
    output{
    	 if [type] == "apache_access.log" {
             	elasticsearch {
          			hosts => ["10.0.0.18:9200"]
          			index=> "apache_access-%{+YYYY-MM}"
        		}
      	}
    	stdout {
    		codec => rubydebug
    	}
    }
    ==============================
    [root@web02 conf.d]# cat grok.conf 
    input {
    	stdin {
    
    	}
    }
    
    
    filter {
    	grok {
    		 match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
    	}
    
    
    }
    
    
    output {
    
    	stdout {
    		codec => rubydebug
    	}
    
    }
    =========================
    [root@web02 conf.d]# cat httpd_redis.conf 
    input {
    	file {
    
    		path => "/var/log/httpd/access_log"
    		start_position => "beginning"
    	}
    
    
    }
    
    output {
    	redis {
    		host => "10.0.0.18"
    		port => "6379"
    		db => "6"
    		data_type => "list"
    		key => "demo"
    
    	}
    
    }
    ============================
    [root@web02 conf.d]# cat nginx.conf 
    input {
    	file {
    		path => "/var/log/nginx/access_log_jason.log"
    		codec => "json"
    		type => "nginx-access-log"
    	}
    
    
    }
    
    
    filter {
    
    
    
    }
    
    
    output {
    	elasticsearch {
    		hosts => ["10.0.0.18:9200"]
    		index => "nginx-access-log-%{+YYYY.MM.dd}"
    
    	}
    	stdout{
    		codec => rubydebug
    	}
    
    }
    ======================
    
    
    [root@web02 conf.d]# cat redis.conf 
    input {
    	stdin {
    
    	}
    
    
    }
    
    
    
    filter {
    
    
    
    }
    
    output {
    	redis {
    
    		host => "10.0.0.18"
    		port  => "6379"
    		db => "6"
    		data_type => "list"
    		key => "demo"
    	}
    
    
    
    }

![1213508-20180126211849272-1233270018.png][]

转载于:https://www.cnblogs.com/gaoyuechen/p/8361635.html

[1213508-20180126211849272-1233270018.png]: /images/20210726/ff5509d7aba143af92aa63a0d741e924.png