cd /etc/logstash/conf.d
/opt/bitnami/ctlscript.sh restart logstash
input
{
beats
{
ssl => false
host => "0.0.0.0"
port => 5044
}
gelf
{
host => "0.0.0.0"
port => 12201
}
http
{
ssl => false
host => "0.0.0.0"
port => 8888
}
tcp
{
mode => "server"
host => "0.0.0.0"
port => 5010
}
udp
{
host => "0.0.0.0"
port => 5000
}
}
filter {
if [type] == "nginx_access" {
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
if [type] == "laravel_error" {
grok {
match => { "message" => "\[%{TIMESTAMP_ISO8601:my_logdate}\] %{DATA:env}\.%{DATA:severity}: %{DATA:message_old}$" }
}
mutate {
rename => {
"@timestamp" => "read_timestamp"
"message_old" => "message"
}
}
date {
match => [ "my_logdate", "yyyy-MM-dd HH:mm:ss" ]
remove_field => "my_logdate"
timezone => "Asia/Shanghai"
}
}
if [type] == "js_error" {
grok {
match => { "message" => "\] \"%{DATA:request}\" \"%{DATA:agent}\" \"%{DATA:extra_fields}\"$" }
}
mutate {
gsub => [
"extra_fields", "\"","",
"extra_fields", "\\x0A","",
"extra_fields", "\\x22",'\"',
"extra_fields", "(\\)",""
]
}
json {
source => "extra_fields"
target => "err_json"
remove_field => ["message", "extra_fields"]
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
}
output
{
// file { path => "/log_test/test-%{type}-%{+YYYY.MM.dd}.log" } // 调试用
if "_grokparsefailure" in [tags] {
file { path => "/log_test/error-%{type}-%{+YYYY.MM.dd}.log" }
}
elasticsearch
{
hosts => ["localhost"]
index => "logstash-%{+YYYY.MM.dd}"
}
}