ELK多行日志收集
版本：filebeat5.2.2日志如下：
192.168.1.187 ["POST www.test.com/Service.asmx"] [""1.0" encoding="utf-8"?>java.lang.UnsatisfiedLinkError: Native method not found: com.igexin.push.extension.mod.SecurityUtils.m:([B[B)[B
at com.igexin.push.extension.mod.SecurityUtils.m(Native Method)
at com.igexin.push.util.EncryptUtils.altAesDecSocket(Unknown Source)
at com.igexin.push.d.a.c.a(Unknown Source)
at com.igexin.push.d.a.c.b(Unknown Source)
at com.igexin.push.d.a.c.a(Unknown Source)
at com.igexin.push.d.a.c.b(Unknown Source)
at com.igexin.push.d.a.c.c(Unknown Source)
at com.igexin.a.a.b.a.a.j.a_(Unknown Source)
at com.igexin.a.a.d.g.a(Unknown Source)
at com.igexin.a.a.d.g.run(Unknown Source)
at java.lang.Thread.run(Thread.java:841)
561128android"]["Dalvik/1.6.0 (Linux; U; Android 4.4.4; SM-G8508S Build/KTU84P)"] ["java\.lang"] 如果不作任何处理，filebeat会把每行日志作为一条数据传输给redis，这样elasticsearch收集到数据就无法把日志分类了。所有必须让filebeat把上面的这条日志当成一条数据传输给redis。
vim filebeat.yml
#=========================== Filebeat prospectors =====
filebeat.prospectors:
#------------------------------ Log prospector --------
- input_type: log
paths:
- c:\programdata\elasticsearch\logs\*
multiline.pattern: ^\d+\.\d+
#日志开头以“数字.数字”的格式开头，不是以此开头的日志计算上一行日志
multiline.negate: true
multiline.match: after
#------------------------------- Redis output --------
output.redis:
enabled: true
hosts: ["192.168.10.10:6379"]
port: 6379
key: log
db: 2
datatype: list
worker: 2
loadbalance: true
logging.to_files: true
logging.files:
页:
[1]