ELK日志分析系统安装，单节点（一）
input {file {
path => "D:\elk\logs\logs.log"
start_position => beginning
type => "one"
}
file {
path => "D:\elk\logs\u_ex%date:~2,2%%date:~5,2%%date:~8,2%.log"
start_position => beginning
type => "two"
}
}
filter {
//Nginx日志收集如果有其它要进行判断
grok {
//logstash自带的过滤%{COMBINEDAPACHELOG}
match => ["message","%{COMBINEDAPACHELOG}"]
}
}
output{
if"_grokparsefailure" in {
}else{
if == "one"{
elasticsearch{
hosts => "192.168.32.44:9200"
index => "one-%{+YYYY.MM.dd}" //索引名
}
stdout{codec => rubydebug}
}
if == "two"{
elasticsearch{
hosts => "192.168.32.44:9200"
index => "two-%{+YYYY.MM.dd}" //索引名
}
stdout{codec => rubydebug}
}
}
}
页:
[1]