logstash2.2.0过滤tomcat日志
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
input {
file {
type => "java-err"
path => "/fsmeeting/tomcat-service/logs/catalina.out"
tags => "java-err"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
}
filter {
if == "java-err" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:date} \[(?<thread_name>.+?)\]-\[(?<log_level>\w+)\]\s*(?<content>.*)"}
}
mutate {
remove_field => "content"
}
if != "ERROR" {
drop {}
}
}
}
output {
elasticsearch {
host => "192.168.5.231"
protocol => "http"
index => "java-err-%{+YYYY.MM.dd}"
}
email {
body => "%{message}"
from => "xxxxxxx"
contenttype => "text/plain; charset=UTF-8"
options => [
"smtpIporHost", "smtp.sina.com",
"userName", "xxxxxxx",
"password", "*********",
"authenticationType", "login"
]
subject => "服务器%{host} %{type}日志异常"
to => "xxxxxxxx"
}
}
去重发日志：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
input {
file {
type => "java-err"
path => "/fsmeeting/tomcat-service/logs/catalina.out"
tags => "java-err"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601}"
negate => true
what => "previous"
}
}
}
filter {
if == "java-err" {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:date} \[(?<thread_name>.+?)\]-\[(?<log_level>\w+)\]\s*(?<content>.*)"}
}
mutate {
remove_field => "content"
}
if == "ERROR" {
throttle {
after_count => 2
key => "%{content}"
add_tag => "throttled"
}
}
if != "ERROR" {
drop {}
}
}
}
output {
elasticsearch {
host => "192.168.5.231"
protocol => "http"
index => "java-err-%{+YYYY.MM.dd}"
}
if "throttled" not in and == "java-err" and == "ERROR"
email {
body => "%{message}"
from => "xxxxxxx"
contenttype => "text/plain; charset=UTF-8"
options => [
"smtpIporHost", "smtp.sina.com",
"userName", "xxxxxxx",
"password", "*********",
"authenticationType", "login"
]
subject => "服务器%{host} %{type}日志异常"
to => "xxxxxxxx"
}
}
}
页:
[1]