使用Logstash收集PHP相关日志

???紵

　　这里收集三种日志

　　PHP的错误日志，PHP-FPM的错误日志和慢查询日志
　　

　　在php.ini中设置
　　error_log = /data/app_data/php/logs/php_errors.log
　　

　　在php-fpm.conf中设置
　　error_log = /data/app_data/php/logs/php-fpm_error.log
　　slowlog = /data/app_data/php/logs/php-fpm_slow.log
　　

　　PHP错误日志如下：

[29-Jan-2015 07:37:44 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library '/data/app_platform/php/lib/php/exte
nsions/no-debug-non-zts-20100525/redis.so' - /data/app_platform/php/lib/php/extensions/no-debug-non-zts-20100525/redis.so
: cannot open shared object file: No such file or directory in Unknown on line 0
[29-Jan-2015 07:37:44 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library '/data/app_platform/php/lib/php/exte
nsions/no-debug-non-zts-20100525/apc.so' - /data/app_platform/php/lib/php/extensions/no-debug-non-zts-20100525/apc.so: ca
nnot open shared object file: No such file or directory in Unknown on line 0
[29-Jan-2015 07:37:44 UTC] PHP Warning:  PHP Startup: Unable to load dynamic library '/data/app_platform/php/lib/php/exte
nsions/no-debug-non-zts-20100525/mongo.so' - /data/app_platform/php/lib/php/extensions/no-debug-non-zts-20100525/mongo.so
: cannot open shared object file: No such file or directory in Unknown on line 0　　

　　PHP-FPM错误日志如下：

[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[30-Jan-2015 10:32:25] ERROR: unable to read what child say: Bad file descriptor (9)
[10-Mar-2015 17:37:11] ERROR: unable to read what child say: Bad file descriptor (9)
[10-Mar-2015 17:37:11] ERROR: unable to read what child say: Bad file descriptor (9)
[10-Mar-2015 21:31:48] ERROR: unable to read what child say: Bad file descriptor (9)　　

　　PHP-FPM的慢查询日志如下：
[11-Mar-2015 16:54:17]  [pool www] pid 12873
script_filename = /data//index.php
[0x00007f497fa5b620] curl_exec() /data//Account.php:221
[0x00007f497fa5a4e0] call() /data/gintama_app/jidong/game_code/app/controllers/Game.php:31
[0x00007fff29eea180] load() unknown:0
[0x00007f497fa59e18] call_user_func_array() /data/library/BaseCtrl.php:20
[0x00007fff29eea470] handoutAction() unknown:0
[0x00007f497fa59400] run() /data//index.php:30
[11-Mar-2015 16:56:46]  [pool www] pid 12881
script_filename = /data/index.php
[0x00007f497fa5b620] curl_exec() /data//Account.php:221
[0x00007f497fa5a4e0] call() /data/Game.php:31
[0x00007fff29eea180] load() unknown:0
[0x00007f497fa59e18] call_user_func_array() /data/library/BaseCtrl.php:20
[0x00007fff29eea470] handoutAction() unknown:0
[0x00007f497fa59400] run() /data/index.php:30　　

　　

　　添加Logstash的配置文件shipper_php-fpm.conf
input {
   file {
          type => "php_errors"
          path => "/data/app_data/php/logs/php_errors.log"
          sincedb_path => "/dev/null"
#          start_position => "beginning"
         }
   file {
          type => "php-fpm_error"
          path => "/data/app_data/php/logs/php-fpm_error.log"
          sincedb_path => "/dev/null"
#          start_position => "beginning"
        }
   file {
          type => "php-fpm_slow"
          path => "/data/app_data/php/logs/php-fpm_slow.log"
          sincedb_path => "/dev/null"
#          start_position => "beginning"
        }
      }
filter {
   if [type] == "php_errors" {
      mutate {
              add_tag => ["zabbix-sender"]
              add_field => [
                "zabbix_host","%{host}",
                "zabbix_item","php.errors"
#                "send_field","%{message}"
                           ]
              }

                             }
   if [type] == "php-fpm_errors"{
      mutate {
              add_tag => ["zabbix-sender"]
              add_field => [
                "zabbix_host","%{host}",
                "zabbix_item","php-fpm.error"
#                "send_field","%{message}"
                           ]
              }

                                }
   if [type] == "php-fpm_slow" {
      multiline {
             pattern => "^(\[0x|$|script_filename)"
             what    => "previous"
                }  
      mutate {
              add_tag => ["zabbix-sender"]
              add_field => [
                "zabbix_host","%{host}",
                "zabbix_item","php-fpm.slow"
#                "send_field","%{message}"
                           ]
              }
                               }
       }

output {
   stdout {
     codec => "rubydebug"
          }
   zabbix {
    tags => "zabbix-sender"
    host => "10.4.1.125"
    port => "10051"
    zabbix_sender => "/usr/local/zabbix/bin/zabbix_sender"
          }
   redis {
     host => "10.4.29.162"
     data_type => "list"
     key => "logstash"
         }

       }　　

　　

　　同理添加zabbixb报警模板