logstash輸出到rabbitmq

場景

　　　　將應用日志文件發送到rabbitmq。

　　filebeat 不支持rabbitmq作為輸出。因此，需要先將文件由filebeat發送到logstash ，再由logstash 輸出到rabbitmq。

 

 

logstash 配置

　　/etc/logstash/conf.d/目錄下創建任意   .conf 文件

#輸入,輸入源為filebeat

input {
    beats {
        port => 5044
        }
}

#過濾無用字段,僅保留message內容
filter {
    mutate {
        remove_field => ["host"]
        remove_field => ["agent"]
        remove_field => ["ecs"]
        remove_field => ["tags"]
        remove_field => ["fields"]
        remove_field => ["@version"]
        remove_field => ["@timestamp"]
        remove_field => ["input"]
        remove_field => ["log"]
        remove_field => ["container"]
    }
}

#輸出，輸出目標為rabbitmq
output{
    rabbitmq {
        id => "my_plugin_id"
        exchange => "exchange-test"     #mq中建立的exchange   必填項
        key => "testkey" 　　　　　　　　　#exchance綁定queue的routekey
        exchange_type => "direct"    　 #mq交換器類型，可為["fanout", "direct", "topic", "x-consistent-hash", "x-modulus-hash"] 必填項
        host => "10.0.0.10"　　　　　　　 #mq地址     必填項
        port => 5672　　　　　　　　　　　
        user => "admin"
        password => "abc11112323"
        vhost  => "test-host" 　　　　　　#mq虛擬主機，默認為/
        message_properties => {
            "content_type" => "application/json"
             "priority" => 1
            }
      }
}
      

 

logstash-rabbitmq output  官方文檔

https://www.elastic.co/guide/en/beats/filebeat/7.x/exported-fields-rabbitmq.html