1.filebeat配置文件:
filebeat.inputs:
- type: log
enabled: true
backoff: "1s"
tail_files: false
paths:
- /usr/local/nginx/logs/access-json.log
fields:
filetype: logjson #加這個兩個文件就是區分的
fields_under_root: true
- type: log
enabled: true
backoff: "1s"
tail_files: false
paths:
- /var/log/messages
fields:
filetype: logsystem
fields_under_root: true
output.logstash:
enabled: true
hosts: ["localhost:5044"] #如果ip不通把localhost換成你的ip
fields:自定義字段
fields_under_root:為true,則自定義字段將為文檔中的頂級字段。
2.logstash配置
input {
beats {
host => "0.0.0.0"
port => 5044
}
}
filter {
if [filetype] == "logjson" {
json {
source => "message"
remove_field => ["beat","offset","tags","prospector"]
}
date {
match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
target => "@timestamp"
}
}
}
output {
if [filetype] == "logjson" {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "nginx-%{+YYYY.MM.dd}"
}
} else if [filetype] == "logsystem" {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "msg-%{+YYYY.MM.dd}"
}
}
}