语法格式

logstash中行为事件，流程:事件---input---codec---filter---codec----output

input{    #注释       stdin{         }}    #可以不用写filter{}output{       elasticsearch{            hosts => ["ip:9200"]                index = "test-%{+YYYY.DD.mm}"         }         stdout{            codec => "rubydebug"         }}

rsyslog日志收集

input{   file{          path => ["/var/log/messages","/var/log/secure"]                type => "system-log"                start_postition => "beginning"     } } filter{}output{  elasticsearch{                       hosts => ["ip:9200"]                                     index => "system-log-%{+YYYY.MM}"        }}

es 日志收集

input{   file{          path => ["/var/log/messages","/var/log/secure"]                type => "system-log"                start_postition => "beginning"         file{                    path => "/var/log/elasticsearch/es.log"                    type => "es-log"                    start_postition => "beginning"                    codec => multiline{                            pattern =>"^\["                                    negate => true                                    what => "previous"                    }          syslog{               type => "system-syslog"                 port => 514            }         }     } } filter{}output{         if [type]=="system-log"{             elasticsearch{                       hosts => ["ip:9200"]                                     index => "system-log-%{+YYYY.MM}"        }        }         if [type]=="es-log"{             elasticsearch{                       hosts => ["ip:9200"]                                     index => "system-log-%{+YYYY.MM}"        }        }        if [type]=="system-syslog"{             elasticsearch{                       hosts => ["ip:9200"]                                     index => "system-syslog-%{+YYYY.MM}"        }        }        stdout{          codec => "rubydebug"        }}

tcp 日志收集

input{   tcp{             type => "tcp"                 port => "6666"                 mode => "server"         }} output{   stdout{           codec => rubydebug         } }

filter插件grok学习

55.3.244.1 GET /index.html 15824 0.043%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}

收集tomcat Apache日志

input{file {    path => "/var/log/access_log"    typ =>"access_log"    start_postition => "beginning"    }}   filter{ grok{     match =>{ "messages" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }       }     }}output{ elasticsearch{             hosts => ["ip:9200"]                     index => "access_log-%{+YYYY.DD.mm}"     } stdout{             codec => "rubydebug"     }}

grok 很耗费性能。一般不这样用。