对于所有日志,我都有原始索引logstash-YYYY.mm.dd.HH。然后我添加了另一个匹配项,以在Elasticsearch中创建第二个索引,该索引具有特定于
的标记“ kubernetes.var.log.containers.cassandra-1_monitoring_cassandra-86d582aa21dce771b3a19fa7b9ba9d5bde743b9520fc133f9cfac3306a942241.log”
我看到的只是索引logstash,没有看到mylogs索引。
<filter kubernetes.**>
@type kubernetes_metadata
</filter>
<match kubernetes.var.log.containers.cassandra**>
@type elasticsearch
logstash_prefix mylogs
logstash_dateformat %Y.%m.%d.%H
host elasticsearch
port 9200
include_tag_key true
buffer_chunk_limit 16M
buffer_queue_limit 4096
flush_interval 30s
max_retry_wait 10s
disable_retry_limit
reload_connections false
</match>
<match **>
@type elasticsearch
logstash_format true
logstash_dateformat %Y.%m.%d.%H
host elasticsearch
port 9200
include_tag_key true
buffer_chunk_limit 16M
buffer_queue_limit 4096
flush_interval 10s
max_retry_wait 10s
disable_retry_limit
reload_connections false
</match>