logstash 收集tomcat log

小鱼儿 2022-02-26 07:52 85阅读 0赞

input {
        file {
            path => "/usr/Elastic/test_tomcat_logs/localhost_access_log*.txt"
            start_position => "beginning"  #从文件开始处读取
            type => "tomcat_access_log"
            #sincedb_path => "/dev/null"
        }
    }
    
    filter {
        if [type] == "tomcat_access_log" {
            grok {
                match => { "message" => "%{COMMONAPACHELOG}" }
            }
    
            kv {
                source => "request"
                field_split => "&?"
                value_split => "="
            }    
    
            urldecode {
                all_fields => true
            }
        }
      
        #定义时间戳的格式
        date {
            match => [ "timestamp", "yyyy-MM-dd-HH:mm:ss" ]
            locale => "cn"
        }
    }
    
    output {
        if [type] == "tomcat_access_log" {
            elasticsearch {
                action => "index" #es要执行的动作
                hosts => ["192.168.1.114:9201","192.168.1.114:9202"]
                #事件要被写进的索引，可是动态的用%{foo}语句
                index => "logstash-tomcat_access_logs-%{+YYYY.MM.dd}"
                #protocol => "http" #这个打开会报错
                #index => "system-message-%{+YYYY.MM.dd}"
                #一个默认的es mapping 模板将启用（除非设置为false 用自己的template）
                #manage_template => true 
                #有效的filepath   设置自己的template文件路径，不设置就用已有的
                #template => "/data1/cloud/logstash-5.5.1/filebeat-template.json" 
                #template_name => "my_index" #在es内部模板的名字
                #template_overwrite => true
                #document_type => "log"
                user => ""
                password => ""
            }
        }
    
        stdout {
            codec => rubydebug
        }
    }