logstash匹配filebeat传递的log.file.path

àì夳堔傛蜴生んèń 2023-02-13 05:39 7阅读 0赞

### 一、filebeat容器 ###

**1. d:/usr2/local/etc/filebeat/目录下filebeat.yml文件配置**

filebeat.inputs:
    - type: log
      enabled: true
      paths:
        - /usr/share/filebeat/log/apps/*/*.log
    
    output.logstash:
        hosts: ["192.168.1.110:5044"]

**2. 启动filebeat**

docker run -v /d/usr/share/filebeat/apps/log:/usr/share/filebeat/log/apps -v /d/usr2/local/etc/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml --name filebeat1 elastic/filebeat:7.7.0

### 二、logstash容器 ###

**1. d:/usr2/local/etc/logstash/pipeline1目录下logstash.conf配置文件**

input { 
        stdin { } 
        beats {
            port => 5044
        }
    }
    
    filter {
        ruby {
            code => "
                path = event.get('log')['file']['path']
                puts format('path = %<path>s', path: path)
                if (!path.nil?) && (!path.empty?)
                    event.set('app', path.split('/')[-2])
                end
            "
        }
    }
    
    output {
    	stdout { codec => rubydebug }
    }

**2. 启动logstash容器**

docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 -p 5044:5044 logstash:7.7.0

### 三、日志文件 ###

**1. d:/usr/share/filebeat/apps/log/test目录下spring-2020-05-27.log**

2020-05-27 17:54:50.805 DEBUG 8296 --- [scheduling-1] org.jooq.tools.LoggerListener            : Executing query          : select id from user

### 四、查看结果 ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3pzeDE4MjczMTE3MDAz_size_16_color_FFFFFF_t_70][]

**从以上结果可以看出获取 log.file.path成功**

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3pzeDE4MjczMTE3MDAz_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200527160702682.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3pzeDE4MjczMTE3MDAz,size_16,color_FFFFFF,t_70